603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe
Size

229KB
MD5

6206c4c73c5534898d5c0af17387a860
SHA1

ffd2d47fc4638d5b11f0ffecdeb4e2189483c55d
SHA256

603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d
SHA512

d0eb7d492cfccff7e265b25d6d75ab26cad1529de41a10b611a449586554f19532f639ce532de8e22475ffc505b77db9c471a6d4e8da10b5a1af870fcb1fd5a1
SSDEEP

6144:O6AIGUnmKHzIWqzzyx8VLRip8SRjTqyl+HKL:DAIGUmKHvSzyx8Vop8Oj/l+HK

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 824	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	27
PID 1380 wrote to memory of 824	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	27
PID 1380 wrote to memory of 824	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	27
PID 1380 wrote to memory of 824	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	27
PID 1380 wrote to memory of 824	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	27
PID 1380 wrote to memory of 824	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	27
PID 1380 wrote to memory of 824	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	27
PID 1380 wrote to memory of 1212	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	19
PID 1380 wrote to memory of 1212	1380	603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe	19

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe
  "C:\Users\Admin\AppData\Local\Temp\603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Users\Admin\AppData\Local\Temp\603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe
    "C:\Users\Admin\AppData\Local\Temp\603b66bb6667f9fd22ce09a280833e652a079fd14d7dbf438fb0a5d31f6b676d.exe"
    3⤵
    PID:824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-57-0x0000000001260000-0x000000000129F000-memory.dmp

Filesize
252KB

Download
memory/1212-58-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1380-60-0x0000000001260000-0x000000000129F000-memory.dmp

Filesize
252KB

Download
memory/1380-61-0x00000000001F0000-0x000000000022F000-memory.dmp

Filesize
252KB

Download