Overview

overview

10

Static

static

739c28b267...15.exe

windows7-x64

10

739c28b267...15.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    130s
  • max time network
    214s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 03:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    739c28b267e45fbc5a4a3ce9374978316725ef90c5d5016921e2df56c7470f15.exe

  • Size

    135KB

  • MD5

    4c409a7a1359758ca822fc5df4773cb3

  • SHA1

    33b9ad618fe471998f1ae25612b278f85b2acb8b

  • SHA256

    739c28b267e45fbc5a4a3ce9374978316725ef90c5d5016921e2df56c7470f15

  • SHA512

    a5e614866e19d7a2c5aa8c7876df6a772dcdeba361ba70f1b8360a8a4c56378f5e75992f210dc2444754680645c93a9247d96cd901b401be04f66d4d1be55460

  • SSDEEP

    3072:FwPOtVECgmaFlt/xUc+Wn2O5nFk3znoWUyJUbyMOjs:OPOH5SlL/+URFfWUyJu0

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\739c28b267e45fbc5a4a3ce9374978316725ef90c5d5016921e2df56c7470f15.exe
    "C:\Users\Admin\AppData\Local\Temp\739c28b267e45fbc5a4a3ce9374978316725ef90c5d5016921e2df56c7470f15.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:668

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Google\Desktop\Install\{f6ae883d-87b2-8e92-33b2-e7745dda3830}\ \...\‮ﯹ๛\{f6ae883d-87b2-8e92-33b2-e7745dda3830}\@
    Filesize

    2KB

    MD5

    b079c583712415f3041c9d94f123cc32

    SHA1

    9d39018fcfd43932f7406a32e1865459ebb9946c

    SHA256

    3ef49f30b027b1f0d7bffa9b9936d512ef1b73c7ef048f7ea1d001b8527cb9d7

    SHA512

    e38939f1877959f7bc66d745e582ff1d9cfbf40d6bbc5691682e5b5ac44fb73e15793a42ad5b4bfcf8159c525b89432eb7a24fb5770654a300414a27c08a81c3

    Download Submit

  • memory/460-59-0x0000000000030000-0x0000000000041000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1156-54-0x0000000075091000-0x0000000075093000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1156-55-0x0000000001000000-0x000000000103D000-memory.dmp

    Filesize

    244KB

    Download

  • memory/1156-57-0x0000000001000000-0x000000000103D000-memory.dmp

    Filesize

    244KB

    Download

  • memory/1156-61-0x0000000001000000-0x000000000103D000-memory.dmp

    Filesize

    244KB

    Download

  • memory/1272-58-0x00000000029B0000-0x00000000029C1000-memory.dmp

    Filesize

    68KB

    Download