9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe
Size

17KB
MD5

850ae9019f2b5c76a5aa8185e4ea9a40
SHA1

f6bf158685f317f73a9bc27404aba609b9b31071
SHA256

9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7
SHA512

096a364af38f96be3c096814d3a51ec0da4079a118a31377f6f6d000b08127ce3c25ea7c58151bf361c565a7db76b3747d7250ea1a9c0eccfe05e711c0ab6ca5
SSDEEP

384:eH4WDg5U83yNrEl3ZnpiHyc2ytkKGbrP6dZxLrO:3ug5U83yNrElu2ekKG36d7

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3032-132-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Kvsc3 = "C:\\Windows\\Kvsc3.exe"	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kvsc3.dll	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Kvsc3.exe	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe
File opened for modification	C:\Windows\Kvsc3.exe	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe
3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe
3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe
3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3068	3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe	46
PID 3032 wrote to memory of 3068	3032	9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe	46

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3068
- C:\Users\Admin\AppData\Local\Temp\9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe
  "C:\Users\Admin\AppData\Local\Temp\9e4f727722d7b4b4ab9ea2cf1692e7bfa1f76eeb4d954644b8a89830387df6f7.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Kvsc3.dll

Filesize
22KB

MD5
1ef780ac7a290f24714acd7ad87a0513

SHA1
88ee89a2b0cbcb26350cebbb6b80b9e95646e3d1

SHA256
39bc18f0d7759e193e965af21acde411854d080a767b799ec72924a7537befbb

SHA512
0f312acdfcb8f81b052027bf7a655727e30f322da3bd3b28d7952f87546017504aa9b1bb98cb83556559dea68115bb97c6d442eb4a8528d16461f29543ca0f58

Download Submit
memory/3032-132-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3068-134-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/3068-133-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download