Overview

overview

10

Static

static

6237525ddd...ed.exe

windows7-x64

10

6237525ddd...ed.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 23:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe

  • Size

    46KB

  • MD5

    54381de81140a945cf0590e6be01de27

  • SHA1

    dd81318257831a988f757a193510659236e18ef5

  • SHA256

    6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed

  • SHA512

    344eadeeb3f7e9c9e9fad0cb79d243b3844652f914b9605021034713141195a9967e61ae9f79fce51c4b628b0dd25c1bd6d71301a62805cfafa3f4c994f41de3

  • SSDEEP

    768:8RRtzKvojqXl5JkRJRuovHZ+k9Oi2KTBkd6nNMI6pQE7B:ARqjpgui5+k9Oi2bcNF+Qi

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe
    "C:\Users\Admin\AppData\Local\Temp\6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Users\Admin\AppData\Local\Temp\8f64a4b.tmp
      "C:\Users\Admin\AppData\Local\Temp\8f64a4b.tmp"
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\8f64a4b.tmp"
        3⤵
          PID:828
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\6237525ddd65fad80bf71ee9acf80a42d456ffc9d30c41cb39dd0a4351f2b9ed.exe"
        2⤵
          PID:3272

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\8f64a4b.tmp
        Filesize

        46KB

        MD5

        31a204ee319fdf730754a0b10ae24815

        SHA1

        1ad218654c868bb1fe8946ff9ebd0f19297559bd

        SHA256

        8adbfdd30f501559475a6f075009634abf15bd779e4cccb1428dfb16c92b8d84

        SHA512

        ab86107ddfd6bff3ed8424daeb36ba8028d4bc115d2d5283470c456dadad8f62a638b1ee30f148b6e06bbd17eb29f121478417aee1935ed239717a6657b5e38b

        Download Submit

      • memory/3036-136-0x0000000000400000-0x000000000040F000-memory.dmp

        Filesize

        60KB

        Download

      • memory/3036-138-0x0000000000400000-0x000000000040F000-memory.dmp

        Filesize

        60KB

        Download

      • memory/4348-135-0x0000000000400000-0x000000000040F000-memory.dmp

        Filesize

        60KB

        Download