d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe
Size

97KB
MD5

6ad7f1197d71e8a10199d9fedaecdd20
SHA1

ccd32f05232cdbf1bd07e4f8bc5bd9c865516ccd
SHA256

d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46
SHA512

c131d81b4790f1aaff59d426a09c66d2628fc0df52e363e5741e79d8b064c3e4be4e7672d23fb3b068574ad55a0d1ac2263daaf58b621d2e3f1ca53374d7aed3
SSDEEP

1536:iufwTSqFEV/PLPkrCdCOFb/4611lM9qSVMcer9FqOyxu2ctvvrDi0HxL:iuW/a7P+CQw11T0V8RFqdxTQ/3t

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	regedit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lsass.exe	d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe
File opened for modification	C:\Windows\SysWOW64\lsass.exe	d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4928	regedit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2160	5072	d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe	83
PID 5072 wrote to memory of 2160	5072	d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe	83
PID 5072 wrote to memory of 2160	5072	d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe	83
PID 2160 wrote to memory of 4928	2160	cmd.exe	85
PID 2160 wrote to memory of 4928	2160	cmd.exe	85
PID 2160 wrote to memory of 4928	2160	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe
"C:\Users\Admin\AppData\Local\Temp\d325d8b6c61083bffbebdbbbb00ac618c1d0e18da0fd4db2dec2f36a8d7edf46.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/2160-135-0x0000000000000000-mapping.dmp

Download
memory/4928-137-0x0000000000000000-mapping.dmp

Download
memory/5072-132-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/5072-133-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/5072-134-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/5072-138-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/5072-140-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/5072-141-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download