Analysis

  • max time kernel
    150s
  • max time network
    171s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 05:51

General

  • Target

    81955b2523c1e54755b3f2d71f379d591daf7bae462f22758c15d5880532c99c.exe

  • Size

    150KB

  • MD5

    db1515716c35b284c4a3d3dcd8824e9f

  • SHA1

    606663f351e0561924d5bef0615dc61019551daf

  • SHA256

    81955b2523c1e54755b3f2d71f379d591daf7bae462f22758c15d5880532c99c

  • SHA512

    dcb6794515a1e27b32f2a40a3462c25edba4d49add9cf68afaa02bf221e971993cca90de7ee385db768e8465c4ff845337a454eb6da5916dcc011253c56be2cd

  • SSDEEP

    3072:wWP56lQojsw6AtswaMTHSsoC5oKb20yuy5vfoVR:dzxe/ZkwGvwVR

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1384
      • C:\Users\Admin\AppData\Local\Temp\81955b2523c1e54755b3f2d71f379d591daf7bae462f22758c15d5880532c99c.exe
        "C:\Users\Admin\AppData\Local\Temp\81955b2523c1e54755b3f2d71f379d591daf7bae462f22758c15d5880532c99c.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Users\Admin\AppData\Local\Temp\81955b2523c1e54755b3f2d71f379d591daf7bae462f22758c15d5880532c99c.exe
          "C:\Users\Admin\AppData\Local\Temp\81955b2523c1e54755b3f2d71f379d591daf7bae462f22758c15d5880532c99c.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1640
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Adds policy Run key to start application
            • Modifies Installed Components in the registry
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1984

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1376-54-0x0000000075921000-0x0000000075923000-memory.dmp

      Filesize

      8KB

    • memory/1384-71-0x0000000010410000-0x0000000010446000-memory.dmp

      Filesize

      216KB

    • memory/1640-60-0x0000000000421100-mapping.dmp

    • memory/1640-79-0x0000000010450000-0x0000000010486000-memory.dmp

      Filesize

      216KB

    • memory/1640-59-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-56-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-62-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-65-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-66-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-68-0x0000000010410000-0x0000000010446000-memory.dmp

      Filesize

      216KB

    • memory/1640-55-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-85-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-73-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-76-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1640-58-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/1984-78-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

      Filesize

      8KB

    • memory/1984-75-0x0000000000000000-mapping.dmp

    • memory/1984-84-0x0000000010450000-0x0000000010486000-memory.dmp

      Filesize

      216KB

    • memory/1984-86-0x0000000010450000-0x0000000010486000-memory.dmp

      Filesize

      216KB

    • memory/1984-87-0x0000000010450000-0x0000000010486000-memory.dmp

      Filesize

      216KB