Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2022 11:13

General

  • Target

    1a6ee9b3aa1d24cabaf8e8fec72cef1d2d1b3e692d4d7d1db7cfc16d10169967.exe

  • Size

    180KB

  • MD5

    977e4e96d9fa52734f24f28d61685ea7

  • SHA1

    0645cac5165dc6883ca4a37b328f271eefef8485

  • SHA256

    1a6ee9b3aa1d24cabaf8e8fec72cef1d2d1b3e692d4d7d1db7cfc16d10169967

  • SHA512

    cb2d4916c9e951c77e3fc20b3377889c680fd897fb382e1b344487eaa204d0359b655dae91866222ef8683a1e22decc9a3d5259d7ec9a7a9f02cde684548d7fe

  • SSDEEP

    3072:ufimO4AYcpO4D2rdUz412nkz/XFm7cMW5Mz5OiqdwsnWJ/sLb5mFggyqWBOB80lv:ufiL4AYcp/EtzfXMeBdwsW1s3Mgfq+O6

Score
8/10

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Unexpected DNS network traffic destination 8 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:684
    • C:\Users\Admin\AppData\Local\Temp\1a6ee9b3aa1d24cabaf8e8fec72cef1d2d1b3e692d4d7d1db7cfc16d10169967.exe
      "C:\Users\Admin\AppData\Local\Temp\1a6ee9b3aa1d24cabaf8e8fec72cef1d2d1b3e692d4d7d1db7cfc16d10169967.exe"
      2⤵
      • Registers COM server for autorun
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/684-134-0x0000000000E30000-0x0000000000E38000-memory.dmp

    Filesize

    32KB

  • memory/764-132-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/764-133-0x00000000005B4000-0x00000000005D7000-memory.dmp

    Filesize

    140KB

  • memory/764-135-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/764-136-0x00000000005B4000-0x00000000005D7000-memory.dmp

    Filesize

    140KB