Resubmissions

25-02-2024 04:58

240225-flvy1scg6z 10

23-02-2024 22:16

240223-165zyaab42 10

23-02-2024 14:27

240223-rsk8yaba65 10

Analysis

  • max time kernel
    209s
  • max time network
    212s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-02-2024 04:58

General

  • Target

    NOT A VIRUS.exe

  • Size

    214KB

  • MD5

    e431cae2c2e7c1d50e2264102d898310

  • SHA1

    7eae6955815fda22dd9ed02302d5f0ca4596854f

  • SHA256

    ff86000c39c061650d004894837d8f618d0724ce3b2a2ef24072c784b2ceb67f

  • SHA512

    74be155fefe642006b7df93aeef53ba34cb950d6172d40782de768ef7437061491b63e7950ef1038d8dbec70e60fa900ce212fd804fb9cb555f337176d99cb1c

  • SSDEEP

    6144:4hQ9z8vM92B+64kQ2EJam2dNREz9FdOZMJwGuE4QyZom8exsrPR5TE7D0XuDTTo6:4hDs2B+64kQHam2dNREz9FdOZMJwGuEu

Score
7/10

Malware Config

Signatures

  • Drops startup file 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 17 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS.exe
    "C:\Users\Admin\AppData\Local\Temp\NOT A VIRUS.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:3012
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2852
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2792
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:956
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1124
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1648
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
      PID:2348
    • C:\Windows\system32\verclsid.exe
      "C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
      1⤵
        PID:2988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2864-0-0x0000000074750000-0x0000000074CFB000-memory.dmp

        Filesize

        5.7MB

      • memory/2864-1-0x0000000074750000-0x0000000074CFB000-memory.dmp

        Filesize

        5.7MB

      • memory/2864-2-0x0000000000BC0000-0x0000000000C00000-memory.dmp

        Filesize

        256KB

      • memory/2864-8-0x0000000074750000-0x0000000074CFB000-memory.dmp

        Filesize

        5.7MB

      • memory/2864-9-0x0000000074750000-0x0000000074CFB000-memory.dmp

        Filesize

        5.7MB

      • memory/2864-10-0x0000000000BC0000-0x0000000000C00000-memory.dmp

        Filesize

        256KB

      • memory/2864-11-0x0000000000BC0000-0x0000000000C00000-memory.dmp

        Filesize

        256KB

      • memory/2864-12-0x0000000000BC0000-0x0000000000C00000-memory.dmp

        Filesize

        256KB

      • memory/2864-13-0x0000000000BC0000-0x0000000000C00000-memory.dmp

        Filesize

        256KB

      • memory/2864-14-0x0000000000BC0000-0x0000000000C00000-memory.dmp

        Filesize

        256KB