f0b75d654cd74a05c254b191cb88c8ef5e6001cb55cba9782dd8855d1eefc818

Analysis

max time kernel
110s
max time network
139s
platform
windows10_x64
resource
win10-en-20210920
submitted
02/11/2021, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a7ce812982cf219ed45f0f77c49cc34.exe
Size 354KB
Sample211102-s9b72ahcdl
SHA256 f0b75d654cd74a05c254b191cb88c8ef5e6001cb55cba9782dd8855d1eefc818
MD5 4a7ce812982cf219ed45f0f77c49cc34
SHA1 17761a5daf56e5f3ced6e007d6f062923802b0c5
SHA512 491df90798d0f5e10b89af1df94e4f28929fcb9e1e4f4b48f4f08054af1c4492e7150a6f2a0ac8651315bac62ae07c1206a514980a86870999beae128ab9a268
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3352	SysPerformance.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	4a7ce812982cf219ed45f0f77c49cc34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{AA28C32F-966C-42C8-A717-F36CCC3CF373} = "C:\\Users\\Admin\\AppData\\Roaming\\{A04F9FB8-60C5-42FE-9C26-A8907E2ABF01}\\SysPerformance.exe"	4a7ce812982cf219ed45f0f77c49cc34.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	4a7ce812982cf219ed45f0f77c49cc34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{AA28C32F-966C-42C8-A717-F36CCC3CF373} = "C:\\Users\\Admin\\AppData\\Roaming\\{A04F9FB8-60C5-42FE-9C26-A8907E2ABF01}\\SysPerformance.exe"	4a7ce812982cf219ed45f0f77c49cc34.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run	4a7ce812982cf219ed45f0f77c49cc34.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\{AA28C32F-966C-42C8-A717-F36CCC3CF373} = "C:\\Users\\Admin\\AppData\\Roaming\\{A04F9FB8-60C5-42FE-9C26-A8907E2ABF01}\\SysPerformance.exe"	4a7ce812982cf219ed45f0f77c49cc34.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3352	2604	4a7ce812982cf219ed45f0f77c49cc34.exe	69
PID 2604 wrote to memory of 3352	2604	4a7ce812982cf219ed45f0f77c49cc34.exe	69
PID 2604 wrote to memory of 3352	2604	4a7ce812982cf219ed45f0f77c49cc34.exe	69

C:\Users\Admin\AppData\Local\Temp\4a7ce812982cf219ed45f0f77c49cc34.exe
"C:\Users\Admin\AppData\Local\Temp\4a7ce812982cf219ed45f0f77c49cc34.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Roaming\{A04F9FB8-60C5-42FE-9C26-A8907E2ABF01}\SysPerformance.exe
  "C:\Users\Admin\AppData\Roaming\{A04F9FB8-60C5-42FE-9C26-A8907E2ABF01}\SysPerformance.exe"
  2⤵
  - Executes dropped EXE
  PID:3352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-116-0x00000000004F0000-0x000000000059E000-memory.dmp

Download

memory/2604-115-0x00000000004F0000-0x000000000059E000-memory.dmp

Download

memory/2604-118-0x0000000000400000-0x0000000000464000-memory.dmp

Download

memory/3352-123-0x00000000020B0000-0x0000000002105000-memory.dmp

Download

memory/3352-122-0x00000000004D0000-0x000000000050C000-memory.dmp

Download

memory/3352-124-0x0000000000400000-0x0000000000464000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads