814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa

Analysis

max time kernel
118s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe
Size

124KB
MD5

006154ef212096ad03b12685136c4c50
SHA1

1b0bcc26c9868c8679402cbc87b5d26d90e7ce32
SHA256

814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa
SHA512

5ee6529c7878b84940a87f3a021f9dc275ec1369d923842fbbd4137c4b69fd18e9644a8b875add22d6c6def5107b540ebc82f14d35458174b5c05a13798d41f4
SSDEEP

1536:mvy50tV44aqwoa9ujdbNyVXa1lgNdaOCt1kTW4:mtWZqwoa9Xa1Idart194

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\35033 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\cccteoan.exe"	msiexec.exe

Blocklisted process makes network request 25 IoCs

flow	pid	Process
7	4868	msiexec.exe
8	4868	msiexec.exe
9	4868	msiexec.exe
10	4868	msiexec.exe
11	4868	msiexec.exe
12	4868	msiexec.exe
13	4868	msiexec.exe
17	4868	msiexec.exe
18	4868	msiexec.exe
21	4868	msiexec.exe
22	4868	msiexec.exe
24	4868	msiexec.exe
25	4868	msiexec.exe
44	4868	msiexec.exe
45	4868	msiexec.exe
46	4868	msiexec.exe
47	4868	msiexec.exe
50	4868	msiexec.exe
51	4868	msiexec.exe
52	4868	msiexec.exe
53	4868	msiexec.exe
55	4868	msiexec.exe
56	4868	msiexec.exe
58	4868	msiexec.exe
59	4868	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3792 set thread context of 2224	3792	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	81

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\cccteoan.exe	msiexec.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2224	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe
2224	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2224	3792	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	81
PID 3792 wrote to memory of 2224	3792	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	81
PID 3792 wrote to memory of 2224	3792	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	81
PID 3792 wrote to memory of 2224	3792	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	81
PID 3792 wrote to memory of 2224	3792	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	81
PID 3792 wrote to memory of 2224	3792	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	81
PID 2224 wrote to memory of 4868	2224	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	82
PID 2224 wrote to memory of 4868	2224	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	82
PID 2224 wrote to memory of 4868	2224	814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe	82

C:\Users\Admin\AppData\Local\Temp\814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe
"C:\Users\Admin\AppData\Local\Temp\814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\AppData\Local\Temp\814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe
  "C:\Users\Admin\AppData\Local\Temp\814e040dcbab569dc28c6ddba6844eeab9926b97c8dc9fa288b4a568557fdeaa.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\syswow64\msiexec.exe
    3⤵
    - Adds policy Run key to start application
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    PID:4868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2224-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4868-138-0x0000000000370000-0x0000000000375000-memory.dmp

Filesize
20KB

Download
memory/4868-137-0x0000000000C40000-0x0000000000C52000-memory.dmp

Filesize
72KB

Download
memory/4868-139-0x0000000000370000-0x0000000000375000-memory.dmp

Filesize
20KB

Download