8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1

Analysis

max time kernel
151s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe
Size

45KB
MD5

6e8e87babf73f866ae1a2dfce54be64b
SHA1

826d2deefbc9630a7da479e33663ffb01c90774b
SHA256

8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1
SHA512

88e344d9b90c4fca2c704d9c97ebc958ebd65c233c832ba7e8a16e3eacd645a290c70dede337f6d9277661e2d8a86ed1609b259fe6c8fcc8dd1c02813a48f23c
SSDEEP

384:yT0cvNDrEVTUq7xMIGRcmg5H8o3LMUBzXZ:yT0cqVPMHccuZ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Event Monitor User = "C:\\Intel\\IAAnotif.exe -s"	8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1404	1444	8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe	28
PID 1444 wrote to memory of 1404	1444	8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe	28
PID 1444 wrote to memory of 1404	1444	8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe	28
PID 1444 wrote to memory of 1404	1444	8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe	28
PID 1404 wrote to memory of 1716	1404	cmd.exe	29
PID 1404 wrote to memory of 1716	1404	cmd.exe	29
PID 1404 wrote to memory of 1716	1404	cmd.exe	29
PID 1404 wrote to memory of 1716	1404	cmd.exe	29

C:\Users\Admin\AppData\Local\Temp\8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe
"C:\Users\Admin\AppData\Local\Temp\8a386b5c4bace81598beccb8a1aced7c62474fe77f18aa66d9159072616ca3c1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=40 lines=20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\mode.com
    mode con cols=40 lines=20
    3⤵
    PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1444-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download