483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9

Analysis

max time kernel
163s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe
Size

120KB
MD5

593f53196e457b3ad3be28c9e07beceb
SHA1

db7ca4b5762b4b22b3127b76a5ff657235d1acb6
SHA256

483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9
SHA512

18f6be6d9f61ad731bf916603cb0c00105f5146302d829bf8033f25648decf7ea5a94b9f843c8e7a21741eb4ad30083186cf135a847bc988875f0df35a90e4b1
SSDEEP

3072:q+l80Y8e3SfsgghMNW8mBTGrCTzimQM6trTmDQ1:Jl+8eOsgghMlmB6mFQM6trCD

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4796	kernels32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	kernels32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service System = "\"c:\\windows\\kernels32.exe\""	kernels32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\kernels32.exe	483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe
File opened for modification	\??\c:\windows\kernels32.exe	483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe
File created	C:\Windows\ieupdate.dat	kernels32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4316	483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe
4796	kernels32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4796	4316	483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe	81
PID 4316 wrote to memory of 4796	4316	483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe	81
PID 4316 wrote to memory of 4796	4316	483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe	81

C:\Users\Admin\AppData\Local\Temp\483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe
"C:\Users\Admin\AppData\Local\Temp\483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316
- \??\c:\windows\kernels32.exe
  c:\windows\kernels32.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\kernels32.exe

Filesize
120KB

MD5
593f53196e457b3ad3be28c9e07beceb

SHA1
db7ca4b5762b4b22b3127b76a5ff657235d1acb6

SHA256
483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9

SHA512
18f6be6d9f61ad731bf916603cb0c00105f5146302d829bf8033f25648decf7ea5a94b9f843c8e7a21741eb4ad30083186cf135a847bc988875f0df35a90e4b1

Download Submit
\??\c:\windows\kernels32.exe

Filesize
120KB

MD5
593f53196e457b3ad3be28c9e07beceb

SHA1
db7ca4b5762b4b22b3127b76a5ff657235d1acb6

SHA256
483699c6f8e09c4e7c6a75e52d062f3e8af53496bf7ab6741c3896accaa8adb9

SHA512
18f6be6d9f61ad731bf916603cb0c00105f5146302d829bf8033f25648decf7ea5a94b9f843c8e7a21741eb4ad30083186cf135a847bc988875f0df35a90e4b1

Download Submit
memory/4316-133-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/4316-142-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/4796-141-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/4796-143-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download