Overview

overview

10

Static

static

3

0a2d543011...0N.exe

windows7-x64

8

0a2d543011...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-09-2024 19:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a2d543011727dddf9b75d7675d3de70N.exe

  • Size

    5.1MB

  • MD5

    0a2d543011727dddf9b75d7675d3de70

  • SHA1

    b27b6da3908efa55898b3cd1dc770c600ff0b280

  • SHA256

    2ad2a247d15a5b5595db3644cea5c838fb3460d9c7622fbbef912d1e54dc3060

  • SHA512

    75e035f29eb55c80a6262a4c2822273795b81cd876709b270382bb1b8c57b6e60d5152098b2549b27fa624ac22b3f99c008c88b83f8aee3445e0fc844e4085f0

  • SSDEEP

    98304:DQOdMiEsjIexzgpsfL/bR/h2ZGZLqxCrNw1tesWe/sURukuUL4HsZj8:sO5jLJL/blh2ZWiCrNw1tr/jRukucKL

Score
8/10
discoveryevasionpersistenceprivilege_escalationvmprotect

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a2d543011727dddf9b75d7675d3de70N.exe
    "C:\Users\Admin\AppData\Local\Temp\0a2d543011727dddf9b75d7675d3de70N.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Users\Admin\AppData\Local\Temp\fmbpPUyvQMw2PQo.exe
      "C:\Users\Admin\AppData\Local\Temp\fmbpPUyvQMw2PQo.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2128
    • C:\Users\Admin\AppData\Local\Temp\SazInject0r.exe
      "C:\Users\Admin\AppData\Local\Temp\SazInject0r.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Users\Admin\AppData\Roaming\Runtime Broker.exe
        "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Runtime Broker.exe" "Runtime Broker.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          • System Time Discovery
          PID:1708
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM SecurityHealthService.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SazInject0r.exe
    Filesize

    37KB

    MD5

    67a4c2acda8c1348429ec9e0ad5af8b3

    SHA1

    1c655c5fc97f3a19d90e35366901625976d29a93

    SHA256

    427e5fd0a2ef91d4dc28ee1443b42969c662829113e19baf3f1fd6b443b50f8d

    SHA512

    fdd32a66b85c3fc3858539a4f07adab1c896d056f44afedce8f75066769ab341706aed44f38c321746ac36b0f866aacf8705f6cdf32ec852e453c9cc0410c04a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\fmbpPUyvQMw2PQo.exe
    Filesize

    5.3MB

    MD5

    9d187e4d0bad6e025578d0b69b476a5b

    SHA1

    a49ebd7d27c8110cedc9a1b6fd96a84095972750

    SHA256

    a22fe41806d8c6239765c70925910fc321c9509e2b865a563ccd48006ca2bb85

    SHA512

    61aea9701304d18151ff76619bba81915346e6ce5f2185a13d3a42dec8d204cee59a380fbf6ba50eb80763bde021357b39f185cc83e47f54967a1b7ab9eb9d8d

    Download Submit

  • memory/2128-11-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2128-12-0x0000000001220000-0x0000000001A40000-memory.dmp

    Filesize

    8.1MB

    Download

  • memory/2716-0-0x000007FEF66F3000-0x000007FEF66F4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2716-1-0x0000000000EE0000-0x00000000013FC000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/2716-2-0x000007FEF66F0000-0x000007FEF70DC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2716-18-0x000007FEF66F0000-0x000007FEF70DC000-memory.dmp

    Filesize

    9.9MB

    Download