b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8

Analysis

max time kernel
148s
max time network
151s
platform
windows10_x64
resource
win10v200430
submitted
29/06/2020, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8.exe
Size 101KB
Sample200629-6tkzasvf72
SHA256 b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8
MD5 bbeb4b22ed3cb2b3ef9e5f18c66b87ef
SHA1 5ee535e8ec7db3f71c73645efc89009c7784ddae
SHA512 2f86a941b99bbe891deac09b608c0ee4220e6ba6955dfef74b347fe8c221d256c19506b44678594ff2f24815d2d928418b371da6b9a5dd65a114cb5979addba9
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1456	2804	b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8.exe	68
PID 2804 wrote to memory of 1456	2804	b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8.exe	68
PID 2804 wrote to memory of 1456	2804	b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8.exe	68
PID 1456 wrote to memory of 1648	1456	images.exe	69
PID 1456 wrote to memory of 1648	1456	images.exe	69
PID 1456 wrote to memory of 1648	1456	images.exe	69
PID 1456 wrote to memory of 1648	1456	images.exe	69
PID 1456 wrote to memory of 1648	1456	images.exe	69

Executes dropped EXE 1 IoCs

pid	Process
1456	images.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8.exe

C:\Users\Admin\AppData\Local\Temp\b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8.exe
"C:\Users\Admin\AppData\Local\Temp\b4dacfa5ab0ebae0bcc9b7b3f5519072e933d4ff20904d6504a0a032f708bdf8.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:2804
- C:\ProgramData\images.exe
  "C:\ProgramData\images.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads