2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe
Size

108KB
MD5

7938cce8cc3a13aa99413ddae6e88e90
SHA1

82a14f7ecc8b9a5c80bcac56bae7d9cf99def43a
SHA256

2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127
SHA512

4085d219b5beeeee4b817a2e6e59f83a99d5c9496cafb6779bc8c32b8d522766b7863fd93ea9b596efcf389af17e58847e64bb1960cd569ccb8c89d8050c21f8
SSDEEP

1536:7hCYGHOZfz5m+iQuVbo7aOak/AkbC+92pkFJ7R1t/QiG4h/gE8i258i268i2e8i2:7hhtDiXbgLLbC+qs7R1tYiGg+x1

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe"	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Serverx.exe	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe
File opened for modification	C:\Windows\SysWOW64\Serverx.exe	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2028	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	28
PID 1116 wrote to memory of 2028	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	28
PID 1116 wrote to memory of 2028	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	28
PID 1116 wrote to memory of 2028	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	28
PID 1116 wrote to memory of 2028	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	28
PID 1116 wrote to memory of 2028	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	28
PID 1116 wrote to memory of 2028	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	28
PID 1116 wrote to memory of 1388	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	11
PID 1116 wrote to memory of 1388	1116	2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe	11

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1388
- C:\Users\Admin\AppData\Local\Temp\2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe
  "C:\Users\Admin\AppData\Local\Temp\2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Users\Admin\AppData\Local\Temp\2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe
    "C:\Users\Admin\AppData\Local\Temp\2bd132eaaeecf4c864f04ab7740b27a5dda39f14d96ca9ec0b111ad252535127.exe"
    3⤵
    PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-54-0x0000000076961000-0x0000000076963000-memory.dmp

Filesize
8KB

Download
memory/1116-60-0x0000000001030000-0x0000000001051000-memory.dmp

Filesize
132KB

Download
memory/1116-61-0x0000000000110000-0x0000000000131000-memory.dmp

Filesize
132KB

Download
memory/1388-57-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download
memory/2028-59-0x0000000001030000-0x0000000001051000-memory.dmp

Filesize
132KB

Download