69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe
Size

148KB
MD5

0d9313b81a59442daa45290979173b85
SHA1

574481c6184b403cad2357ce6da6d2af243beabb
SHA256

69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b
SHA512

7e3126886c9f4aa3eca871b1b4aa03ecdb1ab63193e69265c2238d3d352cd5c0d5e7a58f763476a83c10e66a4aadc43101dbda26e1622b48fac52d057a13dee8
SSDEEP

3072:Wu7FW4IC/TU793SawRC3zp3TzSmyn6h7ECn85BaN+o:X7zrUlDwRUpyj2nqYNL

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1072	ctxmon.exe

Loads dropped DLL 1 IoCs

pid	Process
1916	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ctxmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\IcwRmind	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yazzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctxmon.exe"	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ctxmon.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1072	1916	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe	27
PID 1916 wrote to memory of 1072	1916	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe	27
PID 1916 wrote to memory of 1072	1916	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe	27
PID 1916 wrote to memory of 1072	1916	69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe	27

C:\Users\Admin\AppData\Local\Temp\69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe
"C:\Users\Admin\AppData\Local\Temp\69bd0ffb45247eaf1a4208cefad2e87fb27e4c55afa8506c3d3c12b7a5b6ac3b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
  C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
memory/1916-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1916-60-0x0000000001000000-0x0000000001025000-memory.dmp

Filesize
148KB

Download
memory/1916-61-0x0000000000160000-0x0000000000195000-memory.dmp

Filesize
212KB

Download
memory/1916-62-0x0000000001000000-0x0000000001025000-memory.dmp

Filesize
148KB

Download
memory/1916-63-0x0000000000160000-0x0000000000195000-memory.dmp

Filesize
212KB

Download