Overview

overview

10

Static

static

e589086d37...06.exe

windows7-x64

10

e589086d37...06.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 13:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206.exe

  • Size

    332KB

  • MD5

    8010d3c1f3b1270dce0f1bdaf9b12801

  • SHA1

    42352ce553b5def9499da33a761bb4aa58b3071a

  • SHA256

    e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206

  • SHA512

    64f2a6f38b06d24cd4485dfd45c5ab0535f69a76e73a560a25a173810baac9d72dbd5e2204b00378b43a14fdb5932a773d8b4318b6ab8ad7c9d0d5f20fedca53

  • SSDEEP

    6144:OQhoJR0IVQyNTRpdwBEKqXs/N1P4FjGRhznYwaLy9I0qfPC3Enph4C4z1fT:OQotQQT/ueKeGAMRhbWywHph4

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 17 IoCs
    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206.exe
    "C:\Users\Admin\AppData\Local\Temp\e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\bjm.exe
      "C:\Users\Admin\AppData\Local\bjm.exe" -gav C:\Users\Admin\AppData\Local\Temp\e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1932
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1736
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x594
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1156

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\bjm.exe
    Filesize

    332KB

    MD5

    8010d3c1f3b1270dce0f1bdaf9b12801

    SHA1

    42352ce553b5def9499da33a761bb4aa58b3071a

    SHA256

    e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206

    SHA512

    64f2a6f38b06d24cd4485dfd45c5ab0535f69a76e73a560a25a173810baac9d72dbd5e2204b00378b43a14fdb5932a773d8b4318b6ab8ad7c9d0d5f20fedca53

    Download Submit

  • \Users\Admin\AppData\Local\bjm.exe
    Filesize

    332KB

    MD5

    8010d3c1f3b1270dce0f1bdaf9b12801

    SHA1

    42352ce553b5def9499da33a761bb4aa58b3071a

    SHA256

    e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206

    SHA512

    64f2a6f38b06d24cd4485dfd45c5ab0535f69a76e73a560a25a173810baac9d72dbd5e2204b00378b43a14fdb5932a773d8b4318b6ab8ad7c9d0d5f20fedca53

    Download Submit

  • \Users\Admin\AppData\Local\bjm.exe
    Filesize

    332KB

    MD5

    8010d3c1f3b1270dce0f1bdaf9b12801

    SHA1

    42352ce553b5def9499da33a761bb4aa58b3071a

    SHA256

    e589086d373dc12497f8906e1713a99e7009b52a1dcfa66ab39b38ba420d4206

    SHA512

    64f2a6f38b06d24cd4485dfd45c5ab0535f69a76e73a560a25a173810baac9d72dbd5e2204b00378b43a14fdb5932a773d8b4318b6ab8ad7c9d0d5f20fedca53

    Download Submit

  • memory/1736-68-0x000007FEFC441000-0x000007FEFC443000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1832-65-0x0000000000400000-0x00000000005EE000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1832-59-0x0000000001E20000-0x00000000020CB000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/1832-58-0x0000000000400000-0x00000000005EE000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1832-54-0x0000000076401000-0x0000000076403000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1832-57-0x0000000000230000-0x000000000024D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/1832-56-0x0000000000401000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1832-55-0x0000000000400000-0x00000000005EE000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1932-62-0x0000000000000000-mapping.dmp

    Download

  • memory/1932-69-0x00000000002B0000-0x00000000002CD000-memory.dmp

    Filesize

    116KB

    Download

  • memory/1932-70-0x0000000000400000-0x00000000005EE000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1932-71-0x00000000002B0000-0x00000000002CD000-memory.dmp

    Filesize

    116KB

    Download

  • memory/1932-72-0x0000000073FB1000-0x0000000073FB3000-memory.dmp

    Filesize

    8KB

    Download