57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8

Analysis

max time kernel
21s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
Size

192KB
MD5

437028a01a4c00fdb288affad5b6e12c
SHA1

eb4597ae20c799d10b738e44f41db7afb82b6556
SHA256

57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8
SHA512

0c7676884832c558d5545cc8dab56aa6fbc5e1075ec268f48931a6a7a8fdacbb85789b981c4ff997f2bd1c24d1b4dbd5ea533d2acec694fb03dcfa84075bed4d
SSDEEP

3072:ATeTY1km5WBqwP3gspQ/Xz7iasXbyC/hX6xxv3IUt7jEwj:AiTtiWBvmL7tyJ5Mp3Iy5j

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ball = "C:\\WINDOWS\\Ball.exe"	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\Ball.exe	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
File opened for modification	C:\WINDOWS\Ball.exe	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1620	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
1620	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
1620	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
1620	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
1620	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe

C:\Users\Admin\AppData\Local\Temp\57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe
"C:\Users\Admin\AppData\Local\Temp\57b16adbb0718cfc014002bd383edd1725b9d502dcfccdb0b5705b800a0bede8.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download