954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe
Size

174KB
MD5

20d9e8cd563f2b05cf824f884e1663e0
SHA1

5f9060768d92d550fee9d76b7508d73367d8858c
SHA256

954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2
SHA512

b6213e5accda68cac425c479c021ebb6a317a8acb1690c48453173ec90b61fbfba8f4e8e4412ff3c171c55c4332217a126e8a5d1cf1fd9e183b29ffe08695711
SSDEEP

3072:Fbq9FP/7UNphUaUXWbGCa0/v0wtRegKnb:FYJGOaUmbGBpdnb

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe"	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Serverx.exe	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe
File created	C:\Windows\SysWOW64\Serverx.exe	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1676	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	27
PID 1084 wrote to memory of 1676	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	27
PID 1084 wrote to memory of 1676	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	27
PID 1084 wrote to memory of 1676	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	27
PID 1084 wrote to memory of 1676	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	27
PID 1084 wrote to memory of 1676	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	27
PID 1084 wrote to memory of 1676	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	27
PID 1084 wrote to memory of 1276	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	21
PID 1084 wrote to memory of 1276	1084	954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe
  "C:\Users\Admin\AppData\Local\Temp\954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe
    "C:\Users\Admin\AppData\Local\Temp\954606d0cfd9bae34c32882c4f5084408f105abfd63f3472cc032021d1a81fd2.exe"
    3⤵
    PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1084-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1276-58-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/1676-55-0x0000000000000000-mapping.dmp

Download
memory/1676-57-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download