f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9

Analysis

max time kernel
44s
max time network
64s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe
Size

101KB
MD5

a267bf9e58726a34a91c365b61e1424a
SHA1

081793b4c26d910e652d9ad45c6e54d0c878a2d0
SHA256

f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9
SHA512

17c1d9d8a9ce9753a5b35f8974baa8745e787039b8772374cfc445e592768dbc2417c3572d84e2697972a039c350859ebdd95a0baff291815f7644ec142e37af

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

wintwtv.exe

pid process

960 wintwtv.exe

pid	process
960	wintwtv.exe

Loads dropped DLL 2 IoCs

Processes:

f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe

pid	process
1908	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe
1908	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update 9754865 = "C:\\Windows\\5171888010681849\\wintwtv.exe"	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update 9754865 = "C:\\Windows\\5171888010681849\\wintwtv.exe"	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe

Drops file in Windows directory 3 IoCs

Processes:

f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe

description	ioc	process
File created	C:\Windows\5171888010681849\wintwtv.exe	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe
File opened for modification	C:\Windows\5171888010681849\wintwtv.exe	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe
File opened for modification	C:\Windows\5171888010681849	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe

description	pid	process	target process
PID 1908 wrote to memory of 960	1908	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe	wintwtv.exe
PID 1908 wrote to memory of 960	1908	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe	wintwtv.exe
PID 1908 wrote to memory of 960	1908	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe	wintwtv.exe
PID 1908 wrote to memory of 960	1908	f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe	wintwtv.exe

C:\Users\Admin\AppData\Local\Temp\f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe
"C:\Users\Admin\AppData\Local\Temp\f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\5171888010681849\wintwtv.exe
C:\Windows\5171888010681849\wintwtv.exe
2⤵
- Executes dropped EXE
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\5171888010681849\wintwtv.exe

Filesize
101KB

MD5
a267bf9e58726a34a91c365b61e1424a

SHA1
081793b4c26d910e652d9ad45c6e54d0c878a2d0

SHA256
f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9

SHA512
17c1d9d8a9ce9753a5b35f8974baa8745e787039b8772374cfc445e592768dbc2417c3572d84e2697972a039c350859ebdd95a0baff291815f7644ec142e37af

Download Submit
\Windows\5171888010681849\wintwtv.exe

Filesize
101KB

MD5
a267bf9e58726a34a91c365b61e1424a

SHA1
081793b4c26d910e652d9ad45c6e54d0c878a2d0

SHA256
f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9

SHA512
17c1d9d8a9ce9753a5b35f8974baa8745e787039b8772374cfc445e592768dbc2417c3572d84e2697972a039c350859ebdd95a0baff291815f7644ec142e37af

Download Submit
\Windows\5171888010681849\wintwtv.exe

Filesize
101KB

MD5
a267bf9e58726a34a91c365b61e1424a

SHA1
081793b4c26d910e652d9ad45c6e54d0c878a2d0

SHA256
f9c1bd33a50ec1dc30bba77e179d6342b2172f1162fc4cae3726d6e4563337d9

SHA512
17c1d9d8a9ce9753a5b35f8974baa8745e787039b8772374cfc445e592768dbc2417c3572d84e2697972a039c350859ebdd95a0baff291815f7644ec142e37af

Download Submit
memory/960-60-0x0000000000000000-mapping.dmp

Download
memory/960-62-0x0000000000662000-0x0000000000666000-memory.dmp

Filesize
16KB

Download
memory/960-64-0x0000000000662000-0x0000000000666000-memory.dmp

Filesize
16KB

Download
memory/960-65-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1908-55-0x0000000074DB1000-0x0000000074DB3000-memory.dmp

Filesize
8KB

Download
memory/1908-56-0x0000000000230000-0x0000000000330000-memory.dmp

Filesize
1024KB

Download
memory/1908-57-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download