Overview

overview

8

Static

static

8

5557452490...d7.exe

windows7-x64

8

5557452490...d7.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 09:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    55574524900a8fb459d0050a00c64ac409c66c58084409e7492aec96cb265dd7.exe

  • Size

    27KB

  • MD5

    0c9ee4a8c45b7a5ce276bf629025b5ef

  • SHA1

    1b0a1ae737c9377eaf4bf406afd3870c8144d136

  • SHA256

    55574524900a8fb459d0050a00c64ac409c66c58084409e7492aec96cb265dd7

  • SHA512

    6fb7355bbdeca1c47de3473bcb3d414504266a92ff4c4ff586fe7918497a7f7604c78daf1239372cf79929f425130a7bbd79717e69b23e30187f58c0ff3eec95

  • SSDEEP

    384:u5kAWwLQORlWwOkmEzrU97+KqOyVWZpHVP8NkJ4snGF1DS5+W9781i5GiW4tDSh5:08O/WwOFIrugE4Ni8LzOilveez19zf

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 60 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55574524900a8fb459d0050a00c64ac409c66c58084409e7492aec96cb265dd7.exe
    "C:\Users\Admin\AppData\Local\Temp\55574524900a8fb459d0050a00c64ac409c66c58084409e7492aec96cb265dd7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:4688
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4836
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4628
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:360

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/360-261-0x0000016E95010000-0x0000016E95110000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/360-302-0x0000016E8456B000-0x0000016E8456F000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-307-0x0000016E8456F000-0x0000016E84572000-memory.dmp

    Filesize

    12KB

    Download

  • memory/360-308-0x0000016E8456F000-0x0000016E84572000-memory.dmp

    Filesize

    12KB

    Download

  • memory/360-309-0x0000016E8456F000-0x0000016E84572000-memory.dmp

    Filesize

    12KB

    Download

  • memory/360-146-0x0000016E94560000-0x0000016E94660000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/360-170-0x0000016E843C0000-0x0000016E843E0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/360-180-0x0000016E83DD0000-0x0000016E83DF0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/360-249-0x0000016E8456D000-0x0000016E84571000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-250-0x0000016E8456D000-0x0000016E84571000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-251-0x0000016E8456D000-0x0000016E84571000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-252-0x0000016E8456D000-0x0000016E84571000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-300-0x0000016E8456B000-0x0000016E8456F000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-253-0x0000016E8456D000-0x0000016E84571000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-144-0x0000016E844E0000-0x0000016E84500000-memory.dmp

    Filesize

    128KB

    Download

  • memory/360-262-0x0000016E81930000-0x0000016E81938000-memory.dmp

    Filesize

    32KB

    Download

  • memory/360-292-0x0000016E84568000-0x0000016E8456B000-memory.dmp

    Filesize

    12KB

    Download

  • memory/360-295-0x0000016E84568000-0x0000016E8456B000-memory.dmp

    Filesize

    12KB

    Download

  • memory/360-294-0x0000016E84568000-0x0000016E8456B000-memory.dmp

    Filesize

    12KB

    Download

  • memory/360-293-0x0000016E84568000-0x0000016E8456B000-memory.dmp

    Filesize

    12KB

    Download

  • memory/360-260-0x0000016E95010000-0x0000016E95110000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/360-301-0x0000016E8456B000-0x0000016E8456F000-memory.dmp

    Filesize

    16KB

    Download

  • memory/360-303-0x0000016E8456B000-0x0000016E8456F000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1616-133-0x00000000022C0000-0x00000000026C7000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/1616-132-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1616-142-0x00000000022C0000-0x00000000026C7000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/1616-141-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

    Download