Analysis
- max time kernel
22s - max time network
14s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/03/2024, 14:36
General
- Target VirusShare_0a0391ea8aea3f9c5c78cbf1efffecb0.exe
- Size 117KB
- Sample240302-ryphjsee75
- SHA256 749ddbbeb02965639c532bff4d5736372ba14ab6b2b1b3b3aaae07ea20a6285b
Malware Config
Signatures
- Disables Task Manager via registry modification
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_0a0391ea8aea3f9c5c78cbf1efffecb0.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_0a0391ea8aea3f9c5c78cbf1efffecb0.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3100-0-0x000000001B960000-0x000000001BA06000-memory.dmp
memory/3100-1-0x00007FFBAE310000-0x00007FFBAECB1000-memory.dmp
memory/3100-2-0x00000000014A0000-0x00000000014B0000-memory.dmp
memory/3100-3-0x00007FFBAE310000-0x00007FFBAECB1000-memory.dmp
memory/3100-4-0x000000001C2C0000-0x000000001C78E000-memory.dmp
memory/3100-5-0x000000001C8C0000-0x000000001C95C000-memory.dmp
memory/3100-6-0x0000000001610000-0x0000000001618000-memory.dmp
memory/3100-7-0x000000001C990000-0x000000001C9DC000-memory.dmp
memory/3100-8-0x00000000014A0000-0x00000000014B0000-memory.dmp
memory/3100-12-0x00007FFBAE310000-0x00007FFBAECB1000-memory.dmp
memory/3100-13-0x00000000014A0000-0x00000000014B0000-memory.dmp