68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b

Analysis

max time kernel
62s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
Size

17KB
MD5

7cae83c0c667f4687cd7b305c31c3240
SHA1

864d843cf1877e48ddcc75ecbc2fe9f2a5816bc4
SHA256

68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b
SHA512

5694b6b59988d06844be79b9e2745ad98c97fa8794fcab6552d26d229c9f3ed3753906a4d8406e083973f39e6757089bd5c046dd675cad32ad294de86a4b2873
SSDEEP

192:lfMn88sslYEWz9gsB/nTFVu13l2VjqNKct5qoRug78pT7CIq4X:deHP4RgMTru1IxJSr8pT75q4X

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3220	mswgm.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "0"	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "0"	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Manage Process = "C:\\Windows\\system32\\mswgm.exe"	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mswgm.exe	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
File opened for modification	C:\Windows\SysWOW64\mswgm.exe	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Security	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Security\IEFP = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe"	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3220	4312	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe	83
PID 4312 wrote to memory of 3220	4312	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe	83
PID 4312 wrote to memory of 3220	4312	68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe	83

C:\Users\Admin\AppData\Local\Temp\68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe
"C:\Users\Admin\AppData\Local\Temp\68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b.exe"
1⤵
- Sets file execution options in registry
- Adds Run key to start application
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\mswgm.exe
  C:\Windows\system32\mswgm.exe
  2⤵
  - Executes dropped EXE
  PID:3220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mswgm.exe

Filesize
17KB

MD5
7cae83c0c667f4687cd7b305c31c3240

SHA1
864d843cf1877e48ddcc75ecbc2fe9f2a5816bc4

SHA256
68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b

SHA512
5694b6b59988d06844be79b9e2745ad98c97fa8794fcab6552d26d229c9f3ed3753906a4d8406e083973f39e6757089bd5c046dd675cad32ad294de86a4b2873

Download Submit
C:\Windows\SysWOW64\mswgm.exe

Filesize
17KB

MD5
7cae83c0c667f4687cd7b305c31c3240

SHA1
864d843cf1877e48ddcc75ecbc2fe9f2a5816bc4

SHA256
68d31d1354ac983f8a6036bba9f8653084642dc24d408cec21450661c9da6e5b

SHA512
5694b6b59988d06844be79b9e2745ad98c97fa8794fcab6552d26d229c9f3ed3753906a4d8406e083973f39e6757089bd5c046dd675cad32ad294de86a4b2873

Download Submit
memory/3220-137-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4312-132-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4312-136-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads