039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f

General

Target

039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe
Size

29KB
MD5

509c43bf877011d8e1c91c551bb3bede
SHA1

370d0591e61cd601b3eeadc3fe2b952bd96decdc
SHA256

039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f
SHA512

f01489e37af2c28cb7a09fee9977257e63e3c4e430aec12bac65c427d52fc5db8897c67809e5497199b2127d12501f318272499270b913de4b11fa0b4a43cc8c

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

windrv.exe

pid process

4964 windrv.exe

pid	process
4964	windrv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\T-26207508265082650820840\\windrv.exe"	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\T-26207508265082650820840\\windrv.exe"	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe

Drops file in Windows directory 3 IoCs

Processes:

039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe

description	ioc	process
File opened for modification	C:\Windows\T-26207508265082650820840	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe
File created	C:\Windows\T-26207508265082650820840\windrv.exe	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe
File opened for modification	C:\Windows\T-26207508265082650820840\windrv.exe	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe

description	pid	process	target process
PID 4160 wrote to memory of 4964	4160	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe	windrv.exe
PID 4160 wrote to memory of 4964	4160	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe	windrv.exe
PID 4160 wrote to memory of 4964	4160	039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe	windrv.exe

C:\Users\Admin\AppData\Local\Temp\039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe
"C:\Users\Admin\AppData\Local\Temp\039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4160

C:\Windows\T-26207508265082650820840\windrv.exe
C:\Windows\T-26207508265082650820840\windrv.exe
2⤵
- Executes dropped EXE
PID:4964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\T-26207508265082650820840\windrv.exe
Filesize
29KB

MD5
509c43bf877011d8e1c91c551bb3bede

SHA1
370d0591e61cd601b3eeadc3fe2b952bd96decdc

SHA256
039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f

SHA512
f01489e37af2c28cb7a09fee9977257e63e3c4e430aec12bac65c427d52fc5db8897c67809e5497199b2127d12501f318272499270b913de4b11fa0b4a43cc8c

Download Submit
C:\Windows\T-26207508265082650820840\windrv.exe
Filesize
29KB

MD5
509c43bf877011d8e1c91c551bb3bede

SHA1
370d0591e61cd601b3eeadc3fe2b952bd96decdc

SHA256
039a5dec53f58c8d8b0eaa17dc16e30191003b1cb8accac40d7181e734ccc92f

SHA512
f01489e37af2c28cb7a09fee9977257e63e3c4e430aec12bac65c427d52fc5db8897c67809e5497199b2127d12501f318272499270b913de4b11fa0b4a43cc8c

Download Submit
memory/4964-130-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads