Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
21-09-2022 05:45
General
-
Target
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe
-
Size
202KB
-
MD5
20cd6c97f053cb9771cb76f3a9993968
-
SHA1
031974f83613dfb9d9ca52d5c912d1f3f0b00c82
-
SHA256
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04
-
SHA512
5ee2937df3422180f82b074087935e39933ddfb31f576d86207eeaec734759bc98aaf7047acf34acb31988d9249ca26b38db497a42b7c6817ba43f41b3023a1d
-
SSDEEP
3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIXmT9cx77B7aqetQ0XdeMBma1d:gLV6Bta6dtJmakIM5Kx79PEQ8QVP4
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WAN Manager = "C:\\Program Files (x86)\\WAN Manager\\wanmgr.exe" a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe -
Processes:
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe -
Drops file in Program Files directory 2 IoCs
Processes:
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exedescription ioc process File created C:\Program Files (x86)\WAN Manager\wanmgr.exe a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe File opened for modification C:\Program Files (x86)\WAN Manager\wanmgr.exe a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exepid process 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exepid process 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exedescription pid process Token: SeDebugPrivilege 3876 a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe"C:\Users\Admin\AppData\Local\Temp\a610f9102a9dc023b6fbee5bde5a4ced8b01d5627095913a832964765b372b04.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3876-116-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-117-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-118-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-119-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-120-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-121-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-122-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-123-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-124-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-125-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-126-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-128-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-127-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-129-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-130-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-131-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-132-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-133-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-134-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-135-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-136-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-137-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-138-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-139-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-140-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-141-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-142-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-143-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-144-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-145-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-146-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-147-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-148-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-149-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-150-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-151-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-152-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-153-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-154-0x0000000073150000-0x0000000073700000-memory.dmpFilesize
5.7MB
-
memory/3876-155-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-156-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-157-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-158-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-159-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-160-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-161-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-162-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-163-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-164-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-165-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-166-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-167-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-168-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-169-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-170-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-171-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-172-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-173-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-174-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-175-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-176-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-177-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-178-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-179-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-180-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-193-0x0000000073150000-0x0000000073700000-memory.dmpFilesize
5.7MB