7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9

Analysis

max time kernel
130s
max time network
125s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
Size

162KB
MD5

a3b4559f7af95b91730ebdfa16b4e780
SHA1

36218c5696c6c91a4258e9fd044124ce278ae38c
SHA256

7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9
SHA512

b9e548b6f1a9562366bbe55bcf2c8c52161cb0a71bdd7264be4069393c54acdf7293319f849c1609fcdf6edbd7a7f9d08a637d03c266d1132a813994b06944d0
SSDEEP

1536:pDxPfCCGB2gn61g6Ggoi385XRfguUWiGmV3dZuhTgYmknYh6T0vLy:pDP7uVO3rzwTgYih6TT

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1964	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
1964	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
1964	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
1964	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
1964	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
1964	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
1964	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26
PID 1976 wrote to memory of 1964	1976	7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe	26

C:\Users\Admin\AppData\Local\Temp\7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
"C:\Users\Admin\AppData\Local\Temp\7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe
  "C:\Users\Admin\AppData\Local\Temp\7047b0a65e86309a45b06280e4627ef2b2f67132c2b5e9bf740cac683d8671d9.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-56-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1964-59-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1964-60-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1964-61-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/1964-66-0x0000000000402000-0x0000000000403000-memory.dmp

Filesize
4KB

Download
memory/1964-65-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1964-67-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1964-68-0x0000000002850000-0x0000000002E38000-memory.dmp

Filesize
5.9MB

Download
memory/1964-71-0x0000000002080000-0x00000000020C9000-memory.dmp

Filesize
292KB

Download
memory/1964-70-0x0000000002080000-0x00000000020C9000-memory.dmp

Filesize
292KB

Download
memory/1964-69-0x0000000002850000-0x0000000002E38000-memory.dmp

Filesize
5.9MB

Download
memory/1964-72-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1964-73-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1964-74-0x0000000002080000-0x00000000020CF000-memory.dmp

Filesize
316KB

Download
memory/1964-75-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download
memory/1964-76-0x0000000040960000-0x0000000040971000-memory.dmp

Filesize
68KB

Download
memory/1964-77-0x0000000002080000-0x00000000020DE000-memory.dmp

Filesize
376KB

Download
memory/1964-78-0x0000000002850000-0x0000000002910000-memory.dmp

Filesize
768KB

Download
memory/1964-80-0x0000000000260000-0x000000000026F000-memory.dmp

Filesize
60KB

Download
memory/1964-79-0x0000000002850000-0x0000000002910000-memory.dmp

Filesize
768KB

Download
memory/1964-81-0x0000000000260000-0x000000000026F000-memory.dmp

Filesize
60KB

Download
memory/1964-82-0x0000000002080000-0x00000000020D7000-memory.dmp

Filesize
348KB

Download
memory/1964-83-0x0000000000260000-0x0000000000269000-memory.dmp

Filesize
36KB

Download
memory/1964-84-0x0000000000260000-0x0000000000269000-memory.dmp

Filesize
36KB

Download
memory/1964-85-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1964-87-0x0000000000260000-0x000000000026D000-memory.dmp

Filesize
52KB

Download
memory/1964-86-0x0000000002080000-0x00000000020B3000-memory.dmp

Filesize
204KB

Download
memory/1964-88-0x00000000004B0000-0x00000000004C5000-memory.dmp

Filesize
84KB

Download
memory/1964-90-0x00000000004B0000-0x00000000004CA000-memory.dmp

Filesize
104KB

Download
memory/1964-89-0x0000000002080000-0x00000000020DC000-memory.dmp

Filesize
368KB

Download
memory/1964-91-0x00000000004B0000-0x00000000004CA000-memory.dmp

Filesize
104KB

Download
memory/1964-92-0x0000000000260000-0x0000000000269000-memory.dmp

Filesize
36KB

Download
memory/1964-93-0x0000000000760000-0x000000000078A000-memory.dmp

Filesize
168KB

Download
memory/1964-94-0x0000000000760000-0x000000000078A000-memory.dmp

Filesize
168KB

Download
memory/1964-95-0x0000000000260000-0x000000000026B000-memory.dmp

Filesize
44KB

Download
memory/1964-96-0x0000000000260000-0x000000000026B000-memory.dmp

Filesize
44KB

Download
memory/1964-97-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1964-98-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1964-99-0x0000000002080000-0x00000000020CC000-memory.dmp

Filesize
304KB

Download
memory/1964-100-0x0000000002080000-0x00000000020CC000-memory.dmp

Filesize
304KB

Download
memory/1964-101-0x00000000004B0000-0x00000000004C4000-memory.dmp

Filesize
80KB

Download
memory/1964-102-0x0000000002850000-0x00000000029F3000-memory.dmp

Filesize
1.6MB

Download
memory/1964-103-0x00000000004B0000-0x00000000004CB000-memory.dmp

Filesize
108KB

Download
memory/1964-104-0x0000000002850000-0x00000000028C2000-memory.dmp

Filesize
456KB

Download
memory/1964-106-0x00000000004B0000-0x00000000004C1000-memory.dmp

Filesize
68KB

Download
memory/1964-105-0x0000000002850000-0x00000000028C2000-memory.dmp

Filesize
456KB

Download
memory/1964-107-0x0000000002080000-0x00000000020E0000-memory.dmp

Filesize
384KB

Download
memory/1964-108-0x0000000002080000-0x00000000020E0000-memory.dmp

Filesize
384KB

Download
memory/1964-109-0x0000000000760000-0x000000000078B000-memory.dmp

Filesize
172KB

Download
memory/1964-110-0x0000000000760000-0x000000000078B000-memory.dmp

Filesize
172KB

Download
memory/1964-111-0x0000000002850000-0x0000000002A54000-memory.dmp

Filesize
2.0MB

Download
memory/1964-112-0x0000000002850000-0x0000000002A54000-memory.dmp

Filesize
2.0MB

Download
memory/1964-113-0x0000000002080000-0x00000000020CA000-memory.dmp

Filesize
296KB

Download
memory/1964-114-0x0000000002080000-0x00000000020CA000-memory.dmp

Filesize
296KB

Download
memory/1964-115-0x0000000002080000-0x00000000020CC000-memory.dmp

Filesize
304KB

Download
memory/1964-116-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/1964-117-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/1964-118-0x0000000002080000-0x00000000020BA000-memory.dmp

Filesize
232KB

Download
memory/1964-119-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download
memory/1964-120-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download
memory/1964-121-0x0000000000260000-0x0000000000269000-memory.dmp

Filesize
36KB

Download
memory/1964-124-0x0000000000760000-0x0000000000790000-memory.dmp

Filesize
192KB

Download
memory/1964-123-0x00000000004B0000-0x00000000004C6000-memory.dmp

Filesize
88KB

Download
memory/1964-122-0x00000000004B0000-0x00000000004C6000-memory.dmp

Filesize
88KB

Download
memory/1964-125-0x0000000000760000-0x0000000000790000-memory.dmp

Filesize
192KB

Download
memory/1964-126-0x0000000000760000-0x000000000078A000-memory.dmp

Filesize
168KB

Download
memory/1964-131-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/1964-130-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/1964-129-0x0000000000260000-0x0000000000267000-memory.dmp

Filesize
28KB

Download
memory/1964-128-0x0000000000260000-0x0000000000267000-memory.dmp

Filesize
28KB

Download
memory/1964-127-0x0000000000760000-0x000000000078A000-memory.dmp

Filesize
168KB

Download