Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-06-2024 23:23
Behavioral task
behavioral1
Sample
Test.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
Test.exe
-
Size
202KB
-
MD5
c3e71798c4a13b13b7687a581403f3a6
-
SHA1
5a2fe4c25e3c809ca80d5ac72a001228a69300be
-
SHA256
3981c3975a42b4a3a7bc68831787315ab5cde0348332f81c89d1809f28ad6011
-
SHA512
fbcdfa290ef0b6dd1f8664ae7286eaec7268f1dc0a499439a5c7c37dddc0cd20222282d4b601d02fed706233cd4859f9878e83fe7db78fbde940757fd5e8f1d5
-
SSDEEP
3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIyUmgcZH9Kz2fCdfeCpIT6/Jc8:gLV6Bta6dtJmakIM5qYHk6adGl2w0ssL
Malware Config
Signatures
-
Processes:
Test.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Test.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 33 IoCs
Processes:
flow ioc 48 0.tcp.in.ngrok.io 50 0.tcp.in.ngrok.io 62 0.tcp.in.ngrok.io 8 0.tcp.in.ngrok.io 21 0.tcp.in.ngrok.io 46 0.tcp.in.ngrok.io 56 0.tcp.in.ngrok.io 66 0.tcp.in.ngrok.io 11 0.tcp.in.ngrok.io 32 0.tcp.in.ngrok.io 64 0.tcp.in.ngrok.io 2 0.tcp.in.ngrok.io 23 0.tcp.in.ngrok.io 27 0.tcp.in.ngrok.io 30 0.tcp.in.ngrok.io 38 0.tcp.in.ngrok.io 52 0.tcp.in.ngrok.io 58 0.tcp.in.ngrok.io 68 0.tcp.in.ngrok.io 19 0.tcp.in.ngrok.io 36 0.tcp.in.ngrok.io 44 0.tcp.in.ngrok.io 4 0.tcp.in.ngrok.io 17 0.tcp.in.ngrok.io 40 0.tcp.in.ngrok.io 42 0.tcp.in.ngrok.io 60 0.tcp.in.ngrok.io 6 0.tcp.in.ngrok.io 13 0.tcp.in.ngrok.io 15 0.tcp.in.ngrok.io 25 0.tcp.in.ngrok.io 34 0.tcp.in.ngrok.io 54 0.tcp.in.ngrok.io -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Test.exepid process 2960 Test.exe 2960 Test.exe 2960 Test.exe 2960 Test.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Test.exepid process 2960 Test.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Test.exedescription pid process Token: SeDebugPrivilege 2960 Test.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Test.exe"C:\Users\Admin\AppData\Local\Temp\Test.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Test.exe"C:\Users\Admin\AppData\Local\Temp\Test.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1984-6-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/1984-7-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/1984-8-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/1984-9-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2960-0-0x0000000074B71000-0x0000000074B72000-memory.dmpFilesize
4KB
-
memory/2960-1-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2960-2-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2960-4-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2960-5-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB