63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177

Analysis

max time kernel
159s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
Size

141KB
MD5

4710a64231b6e889cd6c89c61c1858f0
SHA1

9d23174e5d7153424ac5ed197a0f2c59324f9dc1
SHA256

63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177
SHA512

0d0ca7625f479d52a498a7f72d1bf36d916809781535cdefa7e04589cf32abf594c0f8e29d49554e71c43746f43f43bdeb500e81c31e53c23878a247b550709e
SSDEEP

3072:Oq0H6tXEVhbgcCsKvYwB/jAQHZ1orANCevlijwDjxmsfzEMkB1zmqn:+H6eZg9sKvRBRHZYsDFmoAM

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe\" .."	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe\" .."	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe

C:\Users\Admin\AppData\Local\Temp\63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe
"C:\Users\Admin\AppData\Local\Temp\63c2352009723ea245ff43fb9ea973405d6022dec02b3ab791f11eb2953c7177.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5004-132-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download
memory/5004-133-0x0000000074840000-0x0000000074DF1000-memory.dmp

Filesize
5.7MB

Download