01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd

Analysis

max time kernel
140s
max time network
164s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-01-2022 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe
Size

103KB
MD5

e0217714f3a03fae4cdf4b5120213c38
SHA1

56f5790c70b5bdad36fed4cc59ead1bbd2f335f3
SHA256

01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd
SHA512

dc0982bd243a82834985af8d2635595e313998e7ec6e126358b643e8d2846629971af5921f98ca1c7fbc5c9c4212820ec1075085b68a19e7fbb5762ae75eb34c

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\msoclient = "C:\\Users\\Admin\\Documents\\Microsoft-Security\\msoclient.exe"	01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe

pid	Process
3680	01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe
3680	01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe

description	pid	Process
Token: SeDebugPrivilege	3680	01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe

C:\Users\Admin\AppData\Local\Temp\01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe
"C:\Users\Admin\AppData\Local\Temp\01c8d0efc53a616e898816f99d3d3965a9b03ac4d8f4b2f1f4ea64d167b4d7fd.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3680-118-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download