Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 16:44

General

  • Target

    b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe

  • Size

    218KB

  • MD5

    00c40ed16d7549561698a57d38de2d27

  • SHA1

    53575cb2856fbf438db355a2aee8af7a01e9d38c

  • SHA256

    b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c

  • SHA512

    aa16fb450c8157366d1cf98c3af19a7970161feaf0920a9fcbb27fe71b96a3e3898b0557ea202b0ff45fd370ce3141c2e39400a45d3add27843b37575b797dee

  • SSDEEP

    6144:pvsS3rsWqy7xglOsVAkgHiS1Sg9rYsk+RXSaPeBim:CS3XH7C9AkgBLNtSaP

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
  • Modifies security service 2 TTPs 22 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe
    "C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe
      "C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe"
      2⤵
      • Modifies security service
      • Sets service image path in registry
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:108
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        PID:1988

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\‮ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@

          Filesize

          2KB

          MD5

          8d976ffa2a2928f759bca98acd375bdd

          SHA1

          0be05b797a7ec5345f65d9c7f790f4bbffb583cf

          SHA256

          ffb00e26de6ada38dd0746c5ea0dee2f656fb4e1f3b55453ec62aa0022934ea1

          SHA512

          3597e78cb3b4bd729d362e90af97b2236fb26e6ac3587ef82751409341aca7072130e1b9f15668c569dd12160ea899976a85b22b9aaece223671ea9a6de08829

        • memory/108-70-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-62-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-63-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-57-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-64-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-65-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-75-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-60-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-67-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/108-71-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

        • memory/460-73-0x00000000001A0000-0x00000000001B2000-memory.dmp

          Filesize

          72KB

        • memory/460-77-0x00000000001A0000-0x00000000001B2000-memory.dmp

          Filesize

          72KB

        • memory/1248-72-0x0000000002580000-0x0000000002592000-memory.dmp

          Filesize

          72KB

        • memory/1476-68-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1476-54-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1476-56-0x0000000076701000-0x0000000076703000-memory.dmp

          Filesize

          8KB