e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe
Size

299KB
MD5

e625e77f885ce21853cb8f27b7afe5a2
SHA1

c3112965e5d77ececd6811f221dd4fcf843a91a0
SHA256

e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be
SHA512

e49aca96bc4a652337158246067665ce812534ca4d8580e05467390c52842040931b812b44328e775523db586f4f2153e294b754a78d69c8ae46f45d74549b34
SSDEEP

3072:39mBjNnz0MyASqsq1zSpIrhg2IQBECWmThPmNTibTdhJBbZe2T3oT1IuoLs8ZsSF:tmBhgAXsKSp6pISj/d6Ti9h9Sjuyg

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5108	browsup.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	browsup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browsup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\browsup.exe"	browsup.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	browsup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\browsup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\browsup.exe"	browsup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe
4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 5108	4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe	86
PID 4744 wrote to memory of 5108	4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe	86
PID 4744 wrote to memory of 5108	4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe	86
PID 4744 wrote to memory of 3092	4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe	88
PID 4744 wrote to memory of 3092	4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe	88
PID 4744 wrote to memory of 3092	4744	e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe	88

C:\Users\Admin\AppData\Local\Temp\e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe
"C:\Users\Admin\AppData\Local\Temp\e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\browsup.exe
  C:\Users\Admin\AppData\Local\Temp\browsup.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\deleteself.bat
  2⤵
  PID:3092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\browsup.exe

Filesize
299KB

MD5
e625e77f885ce21853cb8f27b7afe5a2

SHA1
c3112965e5d77ececd6811f221dd4fcf843a91a0

SHA256
e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be

SHA512
e49aca96bc4a652337158246067665ce812534ca4d8580e05467390c52842040931b812b44328e775523db586f4f2153e294b754a78d69c8ae46f45d74549b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\browsup.exe

Filesize
299KB

MD5
e625e77f885ce21853cb8f27b7afe5a2

SHA1
c3112965e5d77ececd6811f221dd4fcf843a91a0

SHA256
e82d2671bbec4f0818305e29c5eb5064f3c1c3df2752aba086564f6a06b6a6be

SHA512
e49aca96bc4a652337158246067665ce812534ca4d8580e05467390c52842040931b812b44328e775523db586f4f2153e294b754a78d69c8ae46f45d74549b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\deleteself.bat

Filesize
296B

MD5
0c933bd6165e5b8b11e74bc73a95634d

SHA1
24d101886aa2936eb5cf77ed10a35ccc659a495e

SHA256
a1ce577373ab8fd41d78854e09652d03ce1b98c965ab313b0fa6f7bc3fb040ef

SHA512
94ab45a647637e8ca0fe2a3f3d033360267dff76d913aa682281d4361436d38eed04f62faecc011d7346ffb90a927afcc311f314bf485cd5c20b625e72a81ae9

Download Submit
memory/3092-137-0x0000000000000000-mapping.dmp

Download
memory/4744-132-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4744-138-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/5108-133-0x0000000000000000-mapping.dmp

Download
memory/5108-136-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download