d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
Size

70KB
MD5

00a24b7f6d79d070c6aa154e02d3a6e6
SHA1

e3847d99b1d2d1e3817c2b05ea91027e7a7b77f8
SHA256

d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a
SHA512

bcf2f865b409eadb754e48ed8f4b59f1209109d23fe7edb32f17c024a5f7ae9f890c9912ea883f31a1019372ff796dc39c9a2f0bb395d2a831693acbb1e39c40
SSDEEP

1536:9rUFD/C0WWum6e6mmfASwwb5RUUgojiiAT16dg5Pxx74jv:BcDaNWuhe69fXwwb5RUUgoG/T1Ag534b

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon = "C:\\Windows\\TEMP\\services.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\msmmsgr = "C:\\Windows\\TEMP\\x\\services.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1324	reg.exe
1224	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1588	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	27
PID 1504 wrote to memory of 1588	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	27
PID 1504 wrote to memory of 1588	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	27
PID 1504 wrote to memory of 1588	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	27
PID 1504 wrote to memory of 1652	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	28
PID 1504 wrote to memory of 1652	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	28
PID 1504 wrote to memory of 1652	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	28
PID 1504 wrote to memory of 1652	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	28
PID 1504 wrote to memory of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31
PID 1504 wrote to memory of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31
PID 1504 wrote to memory of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31
PID 1504 wrote to memory of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31
PID 1504 wrote to memory of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31
PID 1504 wrote to memory of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31
PID 1504 wrote to memory of 1396	1504	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	31
PID 1396 wrote to memory of 1208	1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	13
PID 1588 wrote to memory of 1224	1588	cmd.exe	32
PID 1588 wrote to memory of 1224	1588	cmd.exe	32
PID 1588 wrote to memory of 1224	1588	cmd.exe	32
PID 1588 wrote to memory of 1224	1588	cmd.exe	32
PID 1652 wrote to memory of 1324	1652	cmd.exe	33
PID 1652 wrote to memory of 1324	1652	cmd.exe	33
PID 1652 wrote to memory of 1324	1652	cmd.exe	33
PID 1652 wrote to memory of 1324	1652	cmd.exe	33
PID 1396 wrote to memory of 1208	1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	13
PID 1396 wrote to memory of 1208	1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	13
PID 1396 wrote to memory of 1208	1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	13
PID 1396 wrote to memory of 1208	1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	13
PID 1396 wrote to memory of 1208	1396	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
  "C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1324
- - C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
    C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-64-0x000000007EFC0000-0x000000007EFC6000-memory.dmp

Filesize
24KB

Download
memory/1224-60-0x0000000000000000-mapping.dmp

Download
memory/1324-61-0x0000000000000000-mapping.dmp

Download
memory/1396-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1396-57-0x00000000004074ED-mapping.dmp

Download
memory/1396-59-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1396-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1396-63-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/1588-54-0x0000000000000000-mapping.dmp

Download
memory/1652-55-0x0000000000000000-mapping.dmp

Download