b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe
Size

237KB
MD5

9078b0fcc9d7fe3d473ca02f32e3936a
SHA1

be63de581feb0ac9d6bacdf059ed87967ea9cb2a
SHA256

b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257
SHA512

661fc840ad411a029e46f1ef3242a052e106519ad0aa8a8f0354d15829260bf7d561b221329d3494faadb2b82fe11d7fd88a0bccc11425d1e6cd076d4977eda4
SSDEEP

6144:HWstanl+HAmxbEJcf3uqVKtjFuep+UZrUkKzFF:HWlcHlAJ63u/uep+UZr5KzFF

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1600 set thread context of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 856	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	27
PID 1600 wrote to memory of 856	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	27
PID 1600 wrote to memory of 856	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	27
PID 1600 wrote to memory of 856	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	27
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28
PID 1600 wrote to memory of 1700	1600	b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe	28

C:\Users\Admin\AppData\Local\Temp\b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe
"C:\Users\Admin\AppData\Local\Temp\b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe
  "C:\Users\Admin\AppData\Local\Temp\b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe"
  2⤵
  PID:856
- C:\Users\Admin\AppData\Local\Temp\b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe
  "C:\Users\Admin\AppData\Local\Temp\b1e8e7c7607d78ac86cc6927a7d5a6bef383a76ba477a7b7fcd072ffa1935257.exe"
  2⤵
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1600-67-0x0000000074100000-0x00000000746AB000-memory.dmp

Filesize
5.7MB

Download
memory/1700-61-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-63-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-64-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-56-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-59-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-66-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-68-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-57-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-70-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1700-71-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download