8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe
Size

200KB
MD5

1329f0f48eb33d82fe24ef78ede4e526
SHA1

07fcc8281ea9865527a64cc22b3ad7c1bf3ced54
SHA256

8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3
SHA512

c2a18fab9bf2e4278eb6f4e6d65f32883f2cf4f066036ea77dec776c9f27982ad8b737701bcd44c91bcda97d1e2a09ea9ad652c31641c8b5c19bf7749c5bee01
SSDEEP

768:3sPTxLgx8EKs+i9xWElGGeaFlJsD+jzXXQgRG2mvjyl8G3uXRE44o:3ULvs+iVqGJi+XXXQD2+dGuT

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50FF45FD-146D-8BF9-5F25-E3367B6DE79D}	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50FF45FD-146D-8BF9-5F25-E3367B6DE79D}\stubpath = "%SystemRoot%\\system32\\GoogleUpdate.exe"	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GoogleUpdate.exe	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe
File opened for modification	C:\Windows\SysWOW64\GoogleUpdate.exe	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1936	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4932	1936	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe	82
PID 1936 wrote to memory of 4932	1936	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe	82
PID 1936 wrote to memory of 4932	1936	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe	82
PID 1936 wrote to memory of 5020	1936	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe	84
PID 1936 wrote to memory of 5020	1936	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe	84
PID 1936 wrote to memory of 5020	1936	8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe	84

C:\Users\Admin\AppData\Local\Temp\8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe
"C:\Users\Admin\AppData\Local\Temp\8ae91922e0f6533f4011e34cb3f56993c5a90a74352193c6b7df1e3f58113fb3.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{50FF45FD-146D-8BF9-5F25-E3367B6DE79D}" /f
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8AE919~1.EXE > nul
  2⤵
  PID:5020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-132-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1936-135-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download