fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484

Analysis

max time kernel
174s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Size

63KB
MD5

a19364ad5be3be8c64e4e0706be25c4d
SHA1

56d72a21a688d98c115fbc04b9280eb3451c7a0d
SHA256

fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484
SHA512

42a0224e82e3b02a5b4d36dc55d848e8f94855fd01dfbbccf19cd191dc4288436415caa594e96f09ae0ee4a15f2f0a48e0644f9c1d51419a26e8e8be7b7b6b46
SSDEEP

1536:xkYz22fdLuFjnM/smBN6Ub9bAN02rf7OS6PFgyFMkjhPHjdUh7:xRKEQMBBkURJUQuWNH5e7

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 2 IoCs

pid	Process
5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
1804	RunDll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Canvas = "RunDll32 \"C:\\Windows\\system32\\Licenses\\srvlog.dll\",Init"	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Licenses\srvlog.dll	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
File opened for modification	C:\Windows\SysWOW64\Licenses\srvlog.dll	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
File created	C:\Windows\SysWOW64\svclsa.dll	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
File opened for modification	C:\Windows\SysWOW64\svclsa.dll	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\tracing\upmslog.dll	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
File opened for modification	C:\Windows\tracing\upmslog.dll	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 1804	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	82
PID 5112 wrote to memory of 1804	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	82
PID 5112 wrote to memory of 1804	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	82
PID 5112 wrote to memory of 2600	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	79
PID 5112 wrote to memory of 2600	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	79
PID 5112 wrote to memory of 2700	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	78
PID 5112 wrote to memory of 2700	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	78
PID 5112 wrote to memory of 2828	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	77
PID 5112 wrote to memory of 2828	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	77
PID 5112 wrote to memory of 2712	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	75
PID 5112 wrote to memory of 2712	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	75
PID 5112 wrote to memory of 708	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	74
PID 5112 wrote to memory of 708	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	74
PID 5112 wrote to memory of 3256	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	49
PID 5112 wrote to memory of 3256	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	49
PID 5112 wrote to memory of 3352	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	73
PID 5112 wrote to memory of 3352	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	73
PID 5112 wrote to memory of 3416	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	72
PID 5112 wrote to memory of 3416	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	72
PID 5112 wrote to memory of 3500	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	71
PID 5112 wrote to memory of 3500	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	71
PID 5112 wrote to memory of 3688	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	70
PID 5112 wrote to memory of 3688	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	70
PID 5112 wrote to memory of 3324	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	50
PID 5112 wrote to memory of 3324	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	50
PID 5112 wrote to memory of 1804	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	82
PID 5112 wrote to memory of 1804	5112	fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe	82

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3256

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3688

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3500

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3416

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:708

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2712
- C:\Users\Admin\AppData\Local\Temp\fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe
  "C:\Users\Admin\AppData\Local\Temp\fa201757612727359dc63e4e146548deb9c16518ed4f426b3842ee3ce95dc484.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\RunDll32.exe
    RunDll32 "C:\Users\Admin\AppData\Local\Temp\D660.tmp",Init
    3⤵
    - Loads dropped DLL
    PID:1804

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2700

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D660.tmp

Filesize
60KB

MD5
fd2c58ce5c438527eb06323963281a51

SHA1
c9d3e419c845cf7889b6cf847e389ce45dc9243d

SHA256
0f159afe42cd7c2ae759bbcdaea74c78c9ce96eb198e581619880000b23d16c4

SHA512
d4bc4e0298120f78bde64149f9990398f95b5f7d9bf2fd5d8067364e4df76bb261374cf0d55abff3957bf4b2a292616a26fc2dbef654582c025ad3ca83433d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\D660.tmp

Filesize
60KB

MD5
fd2c58ce5c438527eb06323963281a51

SHA1
c9d3e419c845cf7889b6cf847e389ce45dc9243d

SHA256
0f159afe42cd7c2ae759bbcdaea74c78c9ce96eb198e581619880000b23d16c4

SHA512
d4bc4e0298120f78bde64149f9990398f95b5f7d9bf2fd5d8067364e4df76bb261374cf0d55abff3957bf4b2a292616a26fc2dbef654582c025ad3ca83433d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\D660.tmp

Filesize
60KB

MD5
fd2c58ce5c438527eb06323963281a51

SHA1
c9d3e419c845cf7889b6cf847e389ce45dc9243d

SHA256
0f159afe42cd7c2ae759bbcdaea74c78c9ce96eb198e581619880000b23d16c4

SHA512
d4bc4e0298120f78bde64149f9990398f95b5f7d9bf2fd5d8067364e4df76bb261374cf0d55abff3957bf4b2a292616a26fc2dbef654582c025ad3ca83433d12

Download Submit
memory/1804-138-0x0000000075230000-0x0000000075253000-memory.dmp

Filesize
140KB

Download
memory/1804-139-0x0000000075230000-0x0000000075253000-memory.dmp

Filesize
140KB

Download
memory/1804-141-0x0000000075230000-0x0000000075253000-memory.dmp

Filesize
140KB

Download
memory/5112-133-0x0000000075230000-0x0000000075253000-memory.dmp

Filesize
140KB

Download
memory/5112-134-0x0000000075230000-0x0000000075253000-memory.dmp

Filesize
140KB

Download
memory/5112-140-0x0000000075230000-0x0000000075253000-memory.dmp

Filesize
140KB

Download