Analysis

  • max time kernel
    93s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 13:42

General

  • Target

    c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40.exe

  • Size

    180KB

  • MD5

    558cf03642d1f59d58b2aea6fd4d0848

  • SHA1

    270ce62f859508b6339f24ac26111a7bd3c851e6

  • SHA256

    c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40

  • SHA512

    7f446b9005a4f21d3f3660d99da9499c32d2ea750688752b31c792bf30f97f3a04bdd462e634a2f612324ae8cd4cd9cff55d2242cee3253aade67a99b67f2f2e

  • SSDEEP

    3072:ufimO4AYcpO4D2rdUz41Vnkz/XFm7cMW5Mz5OiqdwsnWJ/sLb5mFggyqWBOB80lv:ufiL4AYcp/EQzfXMeBdwsW1s3Mgfq+O6

Score
8/10

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 16 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:464
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1388
    • C:\Users\Admin\AppData\Local\Temp\c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40.exe
      "C:\Users\Admin\AppData\Local\Temp\c3a0da9d5e55ec45df45593074d83aefb3935aaa5ea3b1a75adc6aedb85b9b40.exe"
      2⤵
      • Registers COM server for autorun
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        PID:756

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \systemroot\Installer\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\@

    Filesize

    2KB

    MD5

    3899df69c1e78e9a5b26645561aebafa

    SHA1

    912b4724e81ab73a1987ce4f89a4de34a3b9374f

    SHA256

    4ad5975145ab7c4e4c68d004ba319bff74c7482357944378f1bd842d157c4c75

    SHA512

    fd944cae45caa5db4354c68fc176e93523599ec64914b97fab50a5677036dae56a6c1374b870dfb58a8beb2b7bf93d0644dafeea523d9dd55c6831e95f9d1405

  • memory/464-82-0x00000000000F0000-0x00000000000F8000-memory.dmp

    Filesize

    32KB

  • memory/464-83-0x00000000004B0000-0x00000000004BC000-memory.dmp

    Filesize

    48KB

  • memory/464-72-0x0000000000460000-0x000000000046C000-memory.dmp

    Filesize

    48KB

  • memory/464-76-0x0000000000460000-0x000000000046C000-memory.dmp

    Filesize

    48KB

  • memory/464-78-0x00000000000F0000-0x00000000000F8000-memory.dmp

    Filesize

    32KB

  • memory/464-79-0x00000000004B0000-0x00000000004BC000-memory.dmp

    Filesize

    48KB

  • memory/1388-63-0x0000000002A70000-0x0000000002A7C000-memory.dmp

    Filesize

    48KB

  • memory/1388-55-0x0000000002A70000-0x0000000002A7C000-memory.dmp

    Filesize

    48KB

  • memory/1388-66-0x0000000002A50000-0x0000000002A58000-memory.dmp

    Filesize

    32KB

  • memory/1388-67-0x0000000002A80000-0x0000000002A8C000-memory.dmp

    Filesize

    48KB

  • memory/1388-59-0x0000000002A70000-0x0000000002A7C000-memory.dmp

    Filesize

    48KB

  • memory/1620-64-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/1620-80-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/1620-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

    Filesize

    8KB

  • memory/1620-81-0x00000000008BE000-0x00000000008E1000-memory.dmp

    Filesize

    140KB

  • memory/1620-85-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/1620-65-0x00000000008BE000-0x00000000008E1000-memory.dmp

    Filesize

    140KB

  • memory/1620-86-0x00000000008BE000-0x00000000008E1000-memory.dmp

    Filesize

    140KB