e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe
Size

1.5MB
MD5

04f2c2c070f61665b4980bc50f4794ad
SHA1

3af02a1910053b3a54f7b466712ed9e396bb4051
SHA256

e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b
SHA512

36e9ebe9aecdfb6ecc412e5c5a669318a08ca55c5e1123024d2f6c7cc6ea9e3b6d859ba279c2375381f2946070dfee21035ae165ae0d919a38afc7ffc8771720
SSDEEP

6144:DfAb7nC0WEG05iTh07wHpvel7/70G9R1bAbbTiTL07wHpvel7/70G9R1bAbbTiTB:U95DF+brF+bx95

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5096	stats.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemAutorun.exe	e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StatsSoft = "C:\\Users\\Admin\\AppData\\Roaming\\system app\\stats.exe"	stats.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	stats.exe
Token: SeBackupPrivilege	1592	dw20.exe
Token: SeBackupPrivilege	1592	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 5096	2736	e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe	83
PID 2736 wrote to memory of 5096	2736	e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe	83
PID 2736 wrote to memory of 1592	2736	e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe	84
PID 2736 wrote to memory of 1592	2736	e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe	84

C:\Users\Admin\AppData\Local\Temp\e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe
"C:\Users\Admin\AppData\Local\Temp\e4cd15b149e8adff44add26af316af8175bb9fdcae26a6f473d4df16b99cf51b.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Roaming\system app\stats.exe
  "C:\Users\Admin\AppData\Roaming\system app\stats.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 1696
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\system app\stats.exe

Filesize
11KB

MD5
b5b0b108b14929ed40e2c0be8555b773

SHA1
642d4b1a6a94b37f82382377e8385f77933f57ee

SHA256
069aa4fce7efb5833fb465007ccd4f06d6d4c01305d503a0ba50c671a50639fc

SHA512
a771e29ed421fc3480c042ebf8e711b3e47f4afdbb6e8a1ae481e4d1c18e048c742d7ac8b82573d318eda901f31a68ad2ecaa4f6b7fa3e460a27fb02124000cc

Download Submit
C:\Users\Admin\AppData\Roaming\system app\stats.exe

Filesize
11KB

MD5
b5b0b108b14929ed40e2c0be8555b773

SHA1
642d4b1a6a94b37f82382377e8385f77933f57ee

SHA256
069aa4fce7efb5833fb465007ccd4f06d6d4c01305d503a0ba50c671a50639fc

SHA512
a771e29ed421fc3480c042ebf8e711b3e47f4afdbb6e8a1ae481e4d1c18e048c742d7ac8b82573d318eda901f31a68ad2ecaa4f6b7fa3e460a27fb02124000cc

Download Submit
memory/2736-132-0x00007FF9C3070000-0x00007FF9C3AA6000-memory.dmp

Filesize
10.2MB

Download
memory/5096-136-0x000001DED7570000-0x000001DED757A000-memory.dmp

Filesize
40KB

Download
memory/5096-137-0x00007FF9C1FC0000-0x00007FF9C2A81000-memory.dmp

Filesize
10.8MB

Download
memory/5096-139-0x00007FF9C1FC0000-0x00007FF9C2A81000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads