69fc2c605ffc41b7d121426cc8a48421aa0f04915331d491cef3ad48b78cc3fa

Analysis

max time kernel
47s
max time network
46s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
Size

156KB
MD5

11c9115ed7a92a5496cec4e240cd5dda
SHA1

bfdc6d0e75ac80c8aaf3b6746e74feef158e1b63
SHA256

4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5
SHA512

359c126066052fb3c21129dc22b105a6a29cfa9bd4c903da9a31cb5bdafab5f2cfdcdc6f1dac679e8333b82aaadcf0f5776a1979d0f2be277abbfaac06c87aaf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe"	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1892	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1932	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1892	1932	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe	27
PID 1932 wrote to memory of 1892	1932	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe	27
PID 1932 wrote to memory of 1892	1932	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe	27
PID 1932 wrote to memory of 1892	1932	4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe	27

C:\Users\Admin\AppData\Local\Temp\4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe
"C:\Users\Admin\AppData\Local\Temp\4fc17a5cf81946e26f1846986557801c0a802e56255c7d112cc3edc0d70255d5.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /T /PID 1932
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download