Overview

overview

10

Static

static

666f8cfffe...7e.exe

windows7-x64

10

666f8cfffe...7e.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    182s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 04:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    666f8cfffece9d546ce1243029190ac48bb0daea004afa24a8f81a153090587e.exe

  • Size

    174KB

  • MD5

    8c360590fecce1b28c2dc0aba829d9dd

  • SHA1

    868a91b9dffd5c2b7733577c28453f1646a9ce82

  • SHA256

    666f8cfffece9d546ce1243029190ac48bb0daea004afa24a8f81a153090587e

  • SHA512

    16310632b01eedb00a144e676d562743c103d35efa613e4926a7ac423e387f952171a7612908164e41d39b0f4076a2200e5e8416ff3697c1403fa41ca127b49f

  • SSDEEP

    3072:cBOy/Y7oS40hTuuy5LM/UlqdGlJ1fEjgE2D3vve6Jv6VYfoHgS:cBr1SZhzoLApdEDfEjgED6J5oX

Score
10/10
evasion

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 26 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 6 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Modifies firewall policy service
    • Modifies security service
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:472
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\666f8cfffece9d546ce1243029190ac48bb0daea004afa24a8f81a153090587e.exe
      "C:\Users\Admin\AppData\Local\Temp\666f8cfffece9d546ce1243029190ac48bb0daea004afa24a8f81a153090587e.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        PID:1960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \systemroot\Installer\{f6ae883d-87b2-8e92-33b2-e7745dda3830}\@
    Filesize

    2KB

    MD5

    6f2dd51048486a2827a153fcddab339f

    SHA1

    c93bb94005039452ef0e9b74467cf960b789c7c1

    SHA256

    b532dc058bdd8eef95222d1185f881adbecf57c57a5933a27f8fc7f4a6cfca3c

    SHA512

    091550a4742882860c1b2259f72b063cc58bd38e0f012214c95b6f49d465c536bfbc5d27325aa9c83a6befc187ebca2b2ac4a22128d86888134a7566467bbe38

    Download Submit

  • memory/472-61-0x0000000000130000-0x000000000013F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/472-71-0x0000000000140000-0x000000000014F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/472-70-0x00000000000F0000-0x00000000000FB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/472-69-0x0000000000130000-0x000000000013F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/472-65-0x0000000000130000-0x000000000013F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/2020-58-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-60-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-59-0x0000000000230000-0x000000000027A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-54-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-56-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-72-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-57-0x0000000000230000-0x000000000027A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-55-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/2020-75-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

    Download