2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2

Analysis

max time kernel
129s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13/06/2023, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe
Size

792KB
MD5

c9e9607ec868420a81e325b762650d9d
SHA1

39e875b56f8a46161dcf8f6d1ab41632f9257194
SHA256

2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2
SHA512

fc9eb3a73325e0387a94b01c6f948b7c4274238f9c14e9ebd15938c2aa5b93d1525d69c6d44a0fcf14ed88514d3eb94193b047abcb59c0015f5dbb3eb89e432e
SSDEEP

24576:cXwOrRshqsq1t9TCEQ6JhOZxsVpbuBsV3oO:cgwR2+tO6Jh0s6yloO

Score

7^/10

evasion trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1956	FastCopy.exe

Loads dropped DLL 2 IoCs

pid	Process
2016	2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe
2016	2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FastCopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1956	FastCopy.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	1956	FastCopy.exe
Token: SeRestorePrivilege	1956	FastCopy.exe
Token: SeManageVolumePrivilege	1956	FastCopy.exe
Token: SeSecurityPrivilege	1956	FastCopy.exe
Token: 35	1956	FastCopy.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1956	FastCopy.exe
1956	FastCopy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1956	2016	2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe	28
PID 2016 wrote to memory of 1956	2016	2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe	28
PID 2016 wrote to memory of 1956	2016	2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe	28
PID 2016 wrote to memory of 1956	2016	2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe	28

C:\Users\Admin\AppData\Local\Temp\2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe
"C:\Users\Admin\AppData\Local\Temp\2d16f58c3059698d50193091c24e7abe9066c52b8891adb80abf6edf8333e3f2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FastCopy64\FastCopy.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FastCopy64\FastCopy.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FastCopy64\FastCopy.exe

Filesize
1.1MB

MD5
b7cf90998eb79d3b2e2399d46fce74ba

SHA1
6ca7c3539ed55fc923f51e0fd303191bf989a243

SHA256
8cea42b369307238e7c81b2edfaa0459aa298a563a5c63b69eb5c696c6f49a53

SHA512
934297e240087850db6153cff616695036c623c79550602e596244b4837e7c923bfdfbc6df2959f7f9c5c96a270e02a93211e340760be82918bedfbcd336f4b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FastCopy64\FastCopy.exe

Filesize
1.1MB

MD5
b7cf90998eb79d3b2e2399d46fce74ba

SHA1
6ca7c3539ed55fc923f51e0fd303191bf989a243

SHA256
8cea42b369307238e7c81b2edfaa0459aa298a563a5c63b69eb5c696c6f49a53

SHA512
934297e240087850db6153cff616695036c623c79550602e596244b4837e7c923bfdfbc6df2959f7f9c5c96a270e02a93211e340760be82918bedfbcd336f4b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FastCopy64\FastCopy.exe

Filesize
1.1MB

MD5
b7cf90998eb79d3b2e2399d46fce74ba

SHA1
6ca7c3539ed55fc923f51e0fd303191bf989a243

SHA256
8cea42b369307238e7c81b2edfaa0459aa298a563a5c63b69eb5c696c6f49a53

SHA512
934297e240087850db6153cff616695036c623c79550602e596244b4837e7c923bfdfbc6df2959f7f9c5c96a270e02a93211e340760be82918bedfbcd336f4b2

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FastCopy64\FastCopy.exe

Filesize
1.1MB

MD5
b7cf90998eb79d3b2e2399d46fce74ba

SHA1
6ca7c3539ed55fc923f51e0fd303191bf989a243

SHA256
8cea42b369307238e7c81b2edfaa0459aa298a563a5c63b69eb5c696c6f49a53

SHA512
934297e240087850db6153cff616695036c623c79550602e596244b4837e7c923bfdfbc6df2959f7f9c5c96a270e02a93211e340760be82918bedfbcd336f4b2

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\FastCopy64\FastCopy.exe

Filesize
1.1MB

MD5
b7cf90998eb79d3b2e2399d46fce74ba

SHA1
6ca7c3539ed55fc923f51e0fd303191bf989a243

SHA256
8cea42b369307238e7c81b2edfaa0459aa298a563a5c63b69eb5c696c6f49a53

SHA512
934297e240087850db6153cff616695036c623c79550602e596244b4837e7c923bfdfbc6df2959f7f9c5c96a270e02a93211e340760be82918bedfbcd336f4b2

Download Submit
memory/2016-58-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download