0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe
Size

843KB
MD5

6bf8f292f187526f3092e3a20a3a3700
SHA1

251749af9189bb6e78be08a1fa1ef511d6924d9f
SHA256

0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0
SHA512

5aa8e9d659fa20cf1e42c28007b04734ab04edf3ce5330f6224826e0a75297877702189e856c7c461e946690ebc7f252c48d8f21291f5f2a6b1a44ce299ced2b
SSDEEP

24576:4dTfw+Lc3ZkHhzzxqgJDu+fJArU3PZkYjZ2z9oKxY:l+Lc3ZkH9S+hMU3hkoZuiKxY

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 860	1668	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe	28
PID 1668 wrote to memory of 860	1668	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe	28
PID 1668 wrote to memory of 860	1668	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe	28
PID 1668 wrote to memory of 860	1668	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe	28
PID 1668 wrote to memory of 1268	1668	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe	11
PID 1668 wrote to memory of 1268	1668	0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe	11

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe
  "C:\Users\Admin\AppData\Local\Temp\0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe
    "C:\Users\Admin\AppData\Local\Temp\0a8e2ef8f18874bdb2b7c1d764eadd180533a8b86a6a04beb1a906e974e840e0.exe"
    3⤵
    PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-58-0x00000000009B0000-0x0000000000A88000-memory.dmp

Filesize
864KB

Download
memory/1268-56-0x0000000002A00000-0x0000000002A01000-memory.dmp

Filesize
4KB

Download
memory/1668-54-0x00000000009B0000-0x0000000000A88000-memory.dmp

Filesize
864KB

Download
memory/1668-59-0x00000000009B0000-0x0000000000A88000-memory.dmp

Filesize
864KB

Download