a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67

Analysis

max time kernel
152s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe
Size

876KB
MD5

6a5c6cddc4ca01d6ba2deee90f06e670
SHA1

f32376f65ef2d09a212f3362d300f7460405606d
SHA256

a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67
SHA512

3c5d97c503ca5990e40b80966d5bb5cb1a2f65e7b5fcd0f025d72a6feb64cae975652362c83a728c83bc79cff657c4b869cdd289f2d53c51bc862e587bec200e
SSDEEP

24576:bautr5OUF2PbjR2HJ/rpxzC+3w/wPiX3hH7eDw:bauX2Pbjcp/lyoask

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Executes dropped EXE 2 IoCs

pid	Process
2536	lsass.exe
2224	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.~tmp

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~.pif	lsass.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	lsass.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe
3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe
2536	lsass.exe
2536	lsass.exe
2224	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.~tmp
2224	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.~tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 2536	3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe	81
PID 3448 wrote to memory of 2536	3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe	81
PID 3448 wrote to memory of 2536	3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe	81
PID 3448 wrote to memory of 2224	3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe	82
PID 3448 wrote to memory of 2224	3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe	82
PID 3448 wrote to memory of 2224	3448	a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe	82

C:\Users\Admin\AppData\Local\Temp\a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe
"C:\Users\Admin\AppData\Local\Temp\a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\drivers\lsass.exe
  "C:\Windows\system32\drivers\lsass.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops startup file
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.~tmp
  "C:\Users\Admin\AppData\Local\Temp\a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.~tmp "
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.~tmp

Filesize
812KB

MD5
a440917bfe4a8b145cee4e069c141db5

SHA1
000e7b1fa6a3d652aa864bee602bc2d2b66c4d02

SHA256
24e375185aaf382e037070a738b5bea314ae0dce64c7c34d06cd2a6b2d5a7fe4

SHA512
20f8ad075e31ed05d5fe8c1a533379ba8861d0dd1a07c1f04d65237059aa37171777459d363fccde732fc68f91ac0f752eb7bdd2037b2d8ebb553495b517f203

Download Submit
C:\Users\Admin\AppData\Local\Temp\a63b06c68dc2fcb174076ad195ea6a54dc6b364c4bff0964f191ebb47e9f6c67.~tmp

Filesize
812KB

MD5
a440917bfe4a8b145cee4e069c141db5

SHA1
000e7b1fa6a3d652aa864bee602bc2d2b66c4d02

SHA256
24e375185aaf382e037070a738b5bea314ae0dce64c7c34d06cd2a6b2d5a7fe4

SHA512
20f8ad075e31ed05d5fe8c1a533379ba8861d0dd1a07c1f04d65237059aa37171777459d363fccde732fc68f91ac0f752eb7bdd2037b2d8ebb553495b517f203

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
40ebc6570a89fab99ed3e09b166fcb92

SHA1
a8b54a8d0427ea71c71c4c87f98af5f9aaa1553e

SHA256
8200264a7ff8d90eb94b2270abfa5d0a7c470087ba3e553a22621fbc8a3f45ed

SHA512
499fe869746c19a72130db19c66345747cebb830ce9e409cc7162288157303462285f0f38e9b85bdb4d7936065434bb3f1b5f65fcc8793328a599f8e8b9a423f

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
40ebc6570a89fab99ed3e09b166fcb92

SHA1
a8b54a8d0427ea71c71c4c87f98af5f9aaa1553e

SHA256
8200264a7ff8d90eb94b2270abfa5d0a7c470087ba3e553a22621fbc8a3f45ed

SHA512
499fe869746c19a72130db19c66345747cebb830ce9e409cc7162288157303462285f0f38e9b85bdb4d7936065434bb3f1b5f65fcc8793328a599f8e8b9a423f

Download Submit
memory/2536-136-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2536-140-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3448-135-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download