cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 08:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe
Size

81KB
MD5

487540fe0b9b2deb3d36ff1f941c2560
SHA1

5e91656f439b34d0cb12f35a73c84cea62111b53
SHA256

cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b
SHA512

79bc6bbd9923574e7f8a26f3abe1612073a597b1d231d3755c3005ee83b19f088b6a07a66448cdd72d87635372c73a459c4401a7c1702c4aef92caf2ff9cbbf2
SSDEEP

1536:b1PvKv0h4NFTp8bqEKQJ2OdloVDfjnokT+lH0Ouds8RBXs7RDF61ho:bhQ0hageExJfloR/+0jmyc7RD01ho

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\26696 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\cctcnvypq.pif"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\cctcnvypq.pif	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
944	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe
944	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1876	944	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe	27
PID 944 wrote to memory of 1876	944	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe	27
PID 944 wrote to memory of 1876	944	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe	27
PID 944 wrote to memory of 1876	944	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe	27

C:\Users\Admin\AppData\Local\Temp\cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe
"C:\Users\Admin\AppData\Local\Temp\cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  - Adds policy Run key to start application
  - Drops file in Program Files directory
  PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-54-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1876-56-0x0000000000FB0000-0x0000000000FB8000-memory.dmp

Filesize
32KB

Download
memory/1876-57-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1876-58-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1876-59-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download