Overview

overview

10

Static

static

83c00f4ba3...19.exe

windows7-x64

10

83c00f4ba3...19.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 02:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    83c00f4ba3c99707f913aac9dd13ceb79384a0ca243b880fb679ebe59d42bc19.exe

  • Size

    260KB

  • MD5

    7e716f435c96734fefffad984fc262a9

  • SHA1

    47868edf14866b382313d8930509ec6e081a7236

  • SHA256

    83c00f4ba3c99707f913aac9dd13ceb79384a0ca243b880fb679ebe59d42bc19

  • SHA512

    706b340523c0896a3e5e0ee9ad5f305a4c6c724a5034ba8b2c58308a7c265215d0be958720a81a6c6927512dbd354bebe6c8e7053fc932e97f4550eacabc15af

  • SSDEEP

    6144:QiFPmBODwjr0x9elE6hfg08dsTFuiQTUd:nRmGwjYxof4iuiQc

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83c00f4ba3c99707f913aac9dd13ceb79384a0ca243b880fb679ebe59d42bc19.exe
    "C:\Users\Admin\AppData\Local\Temp\83c00f4ba3c99707f913aac9dd13ceb79384a0ca243b880fb679ebe59d42bc19.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:880

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Desktop\Install\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\ \...\‮ﯹ๛\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\@
          Filesize

          2KB

          MD5

          70724c1f1444c07ac1f71afaadc53336

          SHA1

          8826fb47e36ccd1f3ad3a716a6b1dd257e4839a6

          SHA256

          cb31f99caaf193938d5ba81aa6479b7fa94bdc5ba3d1bd6aea97de4724a8bc4d

          SHA512

          7af11ce18493093b7f6d1f3ecee58a6c8dd01aeed827e49e3401cc66709b48988ee8e6e265fc50e2cc01b3a79f37afdf88243fcda785fbc9d3b0a4dc2a76f48e

          Download Submit

        • memory/460-58-0x00000000001B0000-0x00000000001C1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1324-57-0x00000000021E0000-0x00000000021F1000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1932-55-0x00000000003B0000-0x00000000003F4000-memory.dmp

          Filesize

          272KB

          Download

        • memory/1932-56-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

          Download

        • memory/1932-60-0x0000000000400000-0x0000000000421000-memory.dmp

          Filesize

          132KB

          Download