7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe
Size

936KB
MD5

1df35e8de255cd89d9b12e74faccc7a6
SHA1

b8b87a51b168fa21e1cf53db3258c4887c1413d9
SHA256

7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca
SHA512

3e23e86600274757eb22699c43fddca577fd8b576bb30c626903c636116e06d1861a9e5fc9ddb0db4988972c7d659a030df12ec31458a26a69e093141502e7d6
SSDEEP

6144:m0RxUmakClFBGgkb3t2r4xBVjjExlw6/Pq4lSEks7xibFkEl7yuHVNq8bzMmxUO:m4CnkztY

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe"	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Serverx.exe	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe
File opened for modification	C:\Windows\SysWOW64\Serverx.exe	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1612	1696	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe	28
PID 1696 wrote to memory of 1612	1696	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe	28
PID 1696 wrote to memory of 1612	1696	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe	28
PID 1696 wrote to memory of 1612	1696	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe	28
PID 1696 wrote to memory of 1244	1696	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe	13
PID 1696 wrote to memory of 1244	1696	7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe	13

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe
  "C:\Users\Admin\AppData\Local\Temp\7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe
    "C:\Users\Admin\AppData\Local\Temp\7dea1aaff55b85dbd2f2b5f81b621a18f3e2f27b2f85f1bc84052117cb9c52ca.exe"
    3⤵
    PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-57-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/1612-58-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download
memory/1696-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1696-60-0x0000000000400000-0x0000000000591000-memory.dmp

Filesize
1.6MB

Download
memory/1696-61-0x00000000020A0000-0x0000000002231000-memory.dmp

Filesize
1.6MB

Download