Overview

overview

10

Static

static

e0aef12b5a...fb.exe

windows7-x64

10

e0aef12b5a...fb.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 09:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e0aef12b5add650469602f565833f554a380ede2f1ca0e0d1f21e35d1c4384fb.exe

  • Size

    129KB

  • MD5

    077d1dd4556d145108d75b08b9c5b6c4

  • SHA1

    a7d57b234b518e44836d80bf96e424f6776dbb3c

  • SHA256

    e0aef12b5add650469602f565833f554a380ede2f1ca0e0d1f21e35d1c4384fb

  • SHA512

    7cbff5548898757f1fff506e00b8c0794ff42e10a3f78774d97f5be41b794f8f8912b2ff48cc83aadbb11e03c66ad12d39dab1eceded9b5d1df36bc7fe901272

  • SSDEEP

    3072:+R0h/lwCrnR3HWtId+VO91I2X3ymXJ+eoYxGA/jH:i0saR3HfQVuqbmXJ+FMGAb

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0aef12b5add650469602f565833f554a380ede2f1ca0e0d1f21e35d1c4384fb.exe
    "C:\Users\Admin\AppData\Local\Temp\e0aef12b5add650469602f565833f554a380ede2f1ca0e0d1f21e35d1c4384fb.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:848

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\‮ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@
          Filesize

          2KB

          MD5

          8f826c235090950baa8e873f50885fb0

          SHA1

          56fbe148a32ac80d653efe0d5ef8afe6ca15e388

          SHA256

          d0ebf488dfa13757dec67faf78f884f902f4802e11cc36490179fb19788d1b7a

          SHA512

          fe53a0aa3b7a99fe4369118400b1e929ac18a400c1a905fc440fea8e2fb46eebcdfeee9f446b3f6f58400e9a43911b4eb648ee623e9d198eecd07d43d1007148

          Download Submit

        • memory/464-58-0x00000000000F0000-0x00000000000FE000-memory.dmp

          Filesize

          56KB

          Download

        • memory/464-62-0x00000000000F0000-0x00000000000FE000-memory.dmp

          Filesize

          56KB

          Download

        • memory/1272-57-0x0000000001DC0000-0x0000000001DCE000-memory.dmp

          Filesize

          56KB

          Download

        • memory/1408-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1408-55-0x0000000000240000-0x000000000025F000-memory.dmp

          Filesize

          124KB

          Download

        • memory/1408-56-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

          Download

        • memory/1408-60-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download