Overview

overview

10

Static

static

4a1ac0ef56...75.exe

windows7_x64

10

4a1ac0ef56...75.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    151s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-07-2022 14:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a1ac0ef56181d66b17a7832699348708b2a4efbb70f50be762d2a239bda3a75.exe

  • Size

    88KB

  • MD5

    5b8e159a1b320ca912199595721035f2

  • SHA1

    9e0ebad1ae0b4ad5dc77dcf7c336af2e98ca6e80

  • SHA256

    4a1ac0ef56181d66b17a7832699348708b2a4efbb70f50be762d2a239bda3a75

  • SHA512

    a758d94499fea9a50e00c868de696416d72eaf4dfc9e79989ad99d1fdb4eb79eee17f2b0523b7879d9dcaab1c82dc7d66d61d61ede1cc80d8e4d9fcfe58362d8

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of SetWindowsHookAW 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a1ac0ef56181d66b17a7832699348708b2a4efbb70f50be762d2a239bda3a75.exe
    "C:\Users\Admin\AppData\Local\Temp\4a1ac0ef56181d66b17a7832699348708b2a4efbb70f50be762d2a239bda3a75.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookAW
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\M-5050805868050685086870\winmgr.exe
      C:\Windows\M-5050805868050685086870\winmgr.exe
      2⤵
      • Executes dropped EXE
      PID:4544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\M-5050805868050685086870\winmgr.exe
    Filesize

    88KB

    MD5

    5b8e159a1b320ca912199595721035f2

    SHA1

    9e0ebad1ae0b4ad5dc77dcf7c336af2e98ca6e80

    SHA256

    4a1ac0ef56181d66b17a7832699348708b2a4efbb70f50be762d2a239bda3a75

    SHA512

    a758d94499fea9a50e00c868de696416d72eaf4dfc9e79989ad99d1fdb4eb79eee17f2b0523b7879d9dcaab1c82dc7d66d61d61ede1cc80d8e4d9fcfe58362d8

    Download Submit
  • C:\Windows\M-5050805868050685086870\winmgr.exe
    Filesize

    88KB

    MD5

    5b8e159a1b320ca912199595721035f2

    SHA1

    9e0ebad1ae0b4ad5dc77dcf7c336af2e98ca6e80

    SHA256

    4a1ac0ef56181d66b17a7832699348708b2a4efbb70f50be762d2a239bda3a75

    SHA512

    a758d94499fea9a50e00c868de696416d72eaf4dfc9e79989ad99d1fdb4eb79eee17f2b0523b7879d9dcaab1c82dc7d66d61d61ede1cc80d8e4d9fcfe58362d8

    Download Submit
  • memory/2200-130-0x000000000053E000-0x0000000000543000-memory.dmp
    Filesize

    20KB

    Download
  • memory/2200-131-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/2200-137-0x000000000053E000-0x0000000000543000-memory.dmp
    Filesize

    20KB

    Download
  • memory/2200-139-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/4544-132-0x0000000000000000-mapping.dmp
    Download
  • memory/4544-135-0x000000000062D000-0x0000000000633000-memory.dmp
    Filesize

    24KB

    Download
  • memory/4544-136-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download
  • memory/4544-138-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

    Download