cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 08:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe
Size

81KB
MD5

487540fe0b9b2deb3d36ff1f941c2560
SHA1

5e91656f439b34d0cb12f35a73c84cea62111b53
SHA256

cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b
SHA512

79bc6bbd9923574e7f8a26f3abe1612073a597b1d231d3755c3005ee83b19f088b6a07a66448cdd72d87635372c73a459c4401a7c1702c4aef92caf2ff9cbbf2
SSDEEP

1536:b1PvKv0h4NFTp8bqEKQJ2OdloVDfjnokT+lH0Ouds8RBXs7RDF61ho:bhQ0hageExJfloR/+0jmyc7RD01ho

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\25544 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccjums.exe"	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\ccjums.exe	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3012	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe
3012	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 452	3012	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe	83
PID 3012 wrote to memory of 452	3012	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe	83
PID 3012 wrote to memory of 452	3012	cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe	83

C:\Users\Admin\AppData\Local\Temp\cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe
"C:\Users\Admin\AppData\Local\Temp\cd0e0c09b61a9cbb3b118c1c62122a2a162df9570c80542868abc2a77d9ea01b.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  - Adds policy Run key to start application
  - Drops file in Program Files directory
  PID:452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-135-0x0000000000150000-0x0000000000155000-memory.dmp

Filesize
20KB

Download
memory/452-136-0x0000000000E10000-0x0000000000E1E000-memory.dmp

Filesize
56KB

Download
memory/452-137-0x0000000000430000-0x0000000000439000-memory.dmp

Filesize
36KB

Download
memory/452-138-0x0000000000150000-0x0000000000155000-memory.dmp

Filesize
20KB

Download
memory/3012-132-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/3012-133-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download