a44a8a9525057352a85936d8ea31408f2c5403a5f383bcab9e39fb10e99b628b

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2022, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 309KB
Sample220905-lfww1sefcn
SHA256 a44a8a9525057352a85936d8ea31408f2c5403a5f383bcab9e39fb10e99b628b
MD5 eebc9041dd86d44bc82d892aa2d01931
SHA1 91daddd1715f20bc66dad68d061a8d6f37aedaca
SHA512 fbe6be21917c170c6f6a33e22a2c46312ba76eaef7248a5ea50ec49777fe7df08ae66d488aaa9bdc27b0bf426030e70951112ed56fc2ff6fd31860e7e0ec8199
SSDEEP 6144:Jm/3qMimRuI9A65EUZjGTmzat+t/WGtRTnOuu1:kYUuYA65EUZjumL8GPz
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4956	10.exe
3816	10.exe
4996	msedge.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	10.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdge = "C:\\Users\\Admin\\AppData\\Roaming\\MSEdge\\msedge.exe"	10.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4956 set thread context of 3816	4956	10.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	file.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2184	928	file.exe	83
PID 928 wrote to memory of 2184	928	file.exe	83
PID 2184 wrote to memory of 4956	2184	cmd.exe	85
PID 2184 wrote to memory of 4956	2184	cmd.exe	85
PID 2184 wrote to memory of 4956	2184	cmd.exe	85
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 4956 wrote to memory of 3816	4956	10.exe	87
PID 3816 wrote to memory of 3036	3816	10.exe	97
PID 3816 wrote to memory of 3036	3816	10.exe	97
PID 3816 wrote to memory of 3036	3816	10.exe	97
PID 3036 wrote to memory of 4996	3036	cmd.exe	98
PID 3036 wrote to memory of 4996	3036	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C start C:\Windows\Temp\10.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\Temp\10.exe
    C:\Windows\Temp\10.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\Temp\10.exe
      "C:\Windows\Temp\10.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3036
      - C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
        
        C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
        6⤵
        Executes dropped EXE
        
        PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
Size 16KB
SHA256 7245d7d5573bfbd93e7939ad685b071d7755ebb62d8411f1984ce9dcc195f588
MD5 e8ac4929d4ef413e3c45abe2531cae95
SHA1 9ccd6320f053402699c802425e395010ef915740
SHA512 be3e14f1441839001f41f7c62ce3a5b7fb26927a0d8cd532eab7d000382e143b4f5b5468a60f6223dfecae3d4ad556a7f72b7e5d318783fc1d1858241bfb93e7
SSDEEP 192:7E0Yb7Nnbi/T+8grwf+VR8oxA/29dYCQGqJDNdNbapyCo6O5Xfc1ixJU:7E0Yb79bi/67o/2IJO5o6Gx
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
Size 16KB
SHA256 7245d7d5573bfbd93e7939ad685b071d7755ebb62d8411f1984ce9dcc195f588
MD5 e8ac4929d4ef413e3c45abe2531cae95
SHA1 9ccd6320f053402699c802425e395010ef915740
SHA512 be3e14f1441839001f41f7c62ce3a5b7fb26927a0d8cd532eab7d000382e143b4f5b5468a60f6223dfecae3d4ad556a7f72b7e5d318783fc1d1858241bfb93e7
SSDEEP 192:7E0Yb7Nnbi/T+8grwf+VR8oxA/29dYCQGqJDNdNbapyCo6O5Xfc1ixJU:7E0Yb79bi/67o/2IJO5o6Gx
MD5 SHA1 SHA512 SSDEEP

Submit Download

10.exe

Path C:\Windows\Temp\10.exe
Size 219KB
SHA256 3c968a51021d17597d9de3b6eaaddf35b02036bf06ebd064e2874c462728c6ca
MD5 88a0d61494c4dc8e9614febd1c98d97f
SHA1 48f55dbb3ce39b4091a9ec58949ed477ceeb59a0
SHA512 2c43dc50551368d874a1f7120489784fb42a0dc3e1b66fc5924fc40f9f5a0afd49ff191db8cb16f0702280db01f3920c5145023aaee240936ee1715cd289b1ae
SSDEEP 6144:9R026LgcpHrsuIGtYrGGmTxxxxxxxxS08ioagLe9ayrapDvgHU5f:Y2ypLsSLGmTxxxxxxxxS0zoagLe9Kvg+
MD5 SHA1 SHA512 SSDEEP

Submit Download

10.exe

Path C:\Windows\Temp\10.exe
Size 219KB
SHA256 3c968a51021d17597d9de3b6eaaddf35b02036bf06ebd064e2874c462728c6ca
MD5 88a0d61494c4dc8e9614febd1c98d97f
SHA1 48f55dbb3ce39b4091a9ec58949ed477ceeb59a0
SHA512 2c43dc50551368d874a1f7120489784fb42a0dc3e1b66fc5924fc40f9f5a0afd49ff191db8cb16f0702280db01f3920c5145023aaee240936ee1715cd289b1ae
SSDEEP 6144:9R026LgcpHrsuIGtYrGGmTxxxxxxxxS08ioagLe9ayrapDvgHU5f:Y2ypLsSLGmTxxxxxxxxS0zoagLe9Kvg+
MD5 SHA1 SHA512 SSDEEP

Submit Download

10.exe

Path C:\Windows\Temp\10.exe
Size 219KB
SHA256 3c968a51021d17597d9de3b6eaaddf35b02036bf06ebd064e2874c462728c6ca
MD5 88a0d61494c4dc8e9614febd1c98d97f
SHA1 48f55dbb3ce39b4091a9ec58949ed477ceeb59a0
SHA512 2c43dc50551368d874a1f7120489784fb42a0dc3e1b66fc5924fc40f9f5a0afd49ff191db8cb16f0702280db01f3920c5145023aaee240936ee1715cd289b1ae
SSDEEP 6144:9R026LgcpHrsuIGtYrGGmTxxxxxxxxS08ioagLe9ayrapDvgHU5f:Y2ypLsSLGmTxxxxxxxxS0zoagLe9Kvg+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/928-132-0x000002AC38CE0000-0x000002AC38D34000-memory.dmp

Download

memory/928-133-0x00007FFA05F60000-0x00007FFA06A21000-memory.dmp

Download

memory/928-135-0x00007FFA05F60000-0x00007FFA06A21000-memory.dmp

Download

memory/3816-145-0x0000000000D70000-0x0000000000DA6000-memory.dmp

Download

memory/3816-148-0x0000000000D70000-0x0000000000DA6000-memory.dmp

Download

memory/3816-140-0x0000000000D70000-0x0000000000DA6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads