39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7

Analysis

max time kernel
80s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
Size

204KB
MD5

8dfdf9a1a805ee09c73659842c3d75c4
SHA1

0c9dfd322d38f57fe3c7066b7ca8650ac90202bb
SHA256

39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7
SHA512

813f0d6c4446ec10cadb29774fdba0306afa1a2e9ed390960251ee56e42c17647e1a66a03c8fcd49d2a5034a4d4dacd75e4a6a6b1dd4e694ce1a8874be017a9b
SSDEEP

3072:8qVYtrjsN9NhlcOAeT4WWDQ8KKwirALVd8R1ttfH3J2ex:5KtnsN9Nvc6DWECwyGX8R1P3N

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\V2011 = "C:\\WINDOWS\\V2011.exe"	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\V2011.exe	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
File created	C:\WINDOWS\V2011.exe	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1280	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
1280	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
1280	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
1280	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
1280	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1280	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe

C:\Users\Admin\AppData\Local\Temp\39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe
"C:\Users\Admin\AppData\Local\Temp\39ca258c8b0af3c93933480d098113ace7d5f23aaefb40c811e13cc25eaffcf7.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download