e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33

Analysis

max time kernel
150s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
Size

176KB
MD5

1fb18b10a41bc2902736d723270473ae
SHA1

29b405210f41568b20dac069949e0def4d348ea4
SHA256

e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33
SHA512

c97011a15238a51e5de7979a4f8ef671c12cb95345d13e3b8c29b088280044d3add2b26b21d70db65ecd55f51bbe1522740bdb9dad0e186bde4838017b69c621
SSDEEP

3072:bnplhBzM2pKEW1xK7YRB42YnyA3zqkDE0k/qe3Ex9:bnplh76bUuBcyGqGEz//3EL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe\""	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe\""	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\kb9	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
File created	C:\Windows\Help\kb8	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
File opened for modification	C:\Windows\Help\kb8	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
File created	C:\Windows\Help\kb7	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
File opened for modification	C:\Windows\Help\kb7	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
File created	C:\Windows\Help\kb9	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1516	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
1516	e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe

C:\Users\Admin\AppData\Local\Temp\e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe
"C:\Users\Admin\AppData\Local\Temp\e3340ef722b64540fe484e32f344c855cdfb35c8c116fe6ec95df8f316914e33.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download