06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5

Analysis

max time kernel
188s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe
Size

504KB
MD5

07d3c56b6b3cce9d9a68db7e4c617880
SHA1

117d461c18f4c30e6fd2d0800b1d8de6495a9b74
SHA256

06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5
SHA512

b850cc91e65dab9611934df5244cb46777737a4e24f45bb4e5d7678fc547e97f76d600aca6fb6849b4e204a72bd9ba83849aa5350138a89ae55a907a5b99c1b9
SSDEEP

3072:pePKhyMjEchPDbFZdP3qsK0Z8QlVr63Kt4uNA8ktw/FJBItbuS:gPKJv9DbFZdCsKg8SVAKtVSVeF/yL

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1480	system32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	system32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\system32.exe"	system32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3080	06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe
1480	system32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1480	3080	06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe	81
PID 3080 wrote to memory of 1480	3080	06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe	81
PID 3080 wrote to memory of 1480	3080	06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe	81

C:\Users\Admin\AppData\Local\Temp\06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe
"C:\Users\Admin\AppData\Local\Temp\06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\system32.exe
  C:\Users\Admin\system32.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\System32.exe

Filesize
504KB

MD5
08b9bbaf9ff6a37fc9949cbba5ebd7c2

SHA1
9dd5cf4768239de04d822dd3d0be129a92e71bc8

SHA256
b6dc0b5ae7c39ad852455b5426605d7f58cb0b4f58b79c01d8cfd84a65f378fd

SHA512
d468ec6254d8c51085ee2277ad1a40dc335e71dc99378e6319bf13ccf2b8a92baf4a64b7f9ba04eed82ac7fe7439d49caa2240b6f167fa8310eec6fcbe5fc302

Download Submit
C:\Users\Admin\system32.exe

Filesize
504KB

MD5
08b9bbaf9ff6a37fc9949cbba5ebd7c2

SHA1
9dd5cf4768239de04d822dd3d0be129a92e71bc8

SHA256
b6dc0b5ae7c39ad852455b5426605d7f58cb0b4f58b79c01d8cfd84a65f378fd

SHA512
d468ec6254d8c51085ee2277ad1a40dc335e71dc99378e6319bf13ccf2b8a92baf4a64b7f9ba04eed82ac7fe7439d49caa2240b6f167fa8310eec6fcbe5fc302

Download Submit
memory/1480-140-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1480-142-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/3080-132-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/3080-141-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download