b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a

Analysis

max time kernel
151s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe
Size

208KB
MD5

6f0cf0d753fb227b7acba9a2bb6be7fc
SHA1

4effa881e69d9a53f63c7493f796e739c3d2469a
SHA256

b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a
SHA512

92432f6090bd72175fa19f165bf17d5c80d327e8bf5a9c5dc99feb08d6544588d24c6efc285d5e3e3f8638d2f734894abac2746397501d392aa1e02af7a2b193
SSDEEP

3072:pj7QKrmC/B6DmBvbjjqve4z4PtL2HUpOASklovCIlwll:p4KrmH6vbSveP40p7W3lwv

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1716	lsssass.exe

Loads dropped DLL 2 IoCs

pid	Process
1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe
1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\windows\CurrentVersion\Run	lsssass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsssass = "C:\\Users\\Admin\\AppData\\Roaming\\lsssass.exe"	lsssass.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe
1716	lsssass.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe
1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe
1716	lsssass.exe
1716	lsssass.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1716	1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe	27
PID 1444 wrote to memory of 1716	1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe	27
PID 1444 wrote to memory of 1716	1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe	27
PID 1444 wrote to memory of 1716	1444	b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe	27

C:\Users\Admin\AppData\Local\Temp\b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe
"C:\Users\Admin\AppData\Local\Temp\b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Roaming\lsssass.exe
  C:\Users\Admin\AppData\Roaming\\lsssass.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\lsssass.exe

Filesize
208KB

MD5
6f0cf0d753fb227b7acba9a2bb6be7fc

SHA1
4effa881e69d9a53f63c7493f796e739c3d2469a

SHA256
b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a

SHA512
92432f6090bd72175fa19f165bf17d5c80d327e8bf5a9c5dc99feb08d6544588d24c6efc285d5e3e3f8638d2f734894abac2746397501d392aa1e02af7a2b193

Download Submit
C:\Users\Admin\AppData\Roaming\lsssass.exe

Filesize
208KB

MD5
6f0cf0d753fb227b7acba9a2bb6be7fc

SHA1
4effa881e69d9a53f63c7493f796e739c3d2469a

SHA256
b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a

SHA512
92432f6090bd72175fa19f165bf17d5c80d327e8bf5a9c5dc99feb08d6544588d24c6efc285d5e3e3f8638d2f734894abac2746397501d392aa1e02af7a2b193

Download Submit
\Users\Admin\AppData\Roaming\lsssass.exe

Filesize
208KB

MD5
6f0cf0d753fb227b7acba9a2bb6be7fc

SHA1
4effa881e69d9a53f63c7493f796e739c3d2469a

SHA256
b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a

SHA512
92432f6090bd72175fa19f165bf17d5c80d327e8bf5a9c5dc99feb08d6544588d24c6efc285d5e3e3f8638d2f734894abac2746397501d392aa1e02af7a2b193

Download Submit
\Users\Admin\AppData\Roaming\lsssass.exe

Filesize
208KB

MD5
6f0cf0d753fb227b7acba9a2bb6be7fc

SHA1
4effa881e69d9a53f63c7493f796e739c3d2469a

SHA256
b3c171d188e03fc583496bbbbd399d4f71c8417a815de84a2a54834e5599d69a

SHA512
92432f6090bd72175fa19f165bf17d5c80d327e8bf5a9c5dc99feb08d6544588d24c6efc285d5e3e3f8638d2f734894abac2746397501d392aa1e02af7a2b193

Download Submit
memory/1444-56-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1716-59-0x0000000000000000-mapping.dmp

Download