e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
Size

2.8MB
MD5

e94e3bfafe7459493e66618831b50c52
SHA1

6f42cac19dd9367f0415d53ec49fd476e1232229
SHA256

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13
SHA512

6575ddddcb5897f8f899020f72fa20409a5952e04fd9e52e969847946b3d289fbd5ddae55a2ff3613e680b5959392a88437dd9be4eb4e04ff7344acf599c1f90
SSDEEP

49152:kVg5tQ7arH5AhiTsF8SmAUgrvLjj2sm964xh3Jq6AUtfgXXPUhU4JC+:Og56RhiYFDH3yTBxvA22XsJ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Run = "\"C:\\Users\\Admin\\AppData\\Local\\admin_Control.exe\""	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

description	pid	process	target process
PID 4836 set thread context of 4996	4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

pid process

4996 e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

pid	process
4996	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

pid	process
4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

pid	process
4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

description	pid	process	target process
PID 4836 wrote to memory of 4996	4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
PID 4836 wrote to memory of 4996	4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
PID 4836 wrote to memory of 4996	4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
PID 4836 wrote to memory of 4996	4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
PID 4836 wrote to memory of 4996	4836	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe	e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe

C:\Users\Admin\AppData\Local\Temp\e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
"C:\Users\Admin\AppData\Local\Temp\e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe
  "C:\Users\Admin\AppData\Local\Temp\e7304caaf60367a96b6a716daefabb7aaad0fb73dec54ae835b0ac29973f1a13.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4996-132-0x0000000000000000-mapping.dmp

Download
memory/4996-133-0x0000000000AC0000-0x0000000000CC2000-memory.dmp

Filesize
2.0MB

Download
memory/4996-134-0x0000000000AC0000-0x0000000000CC2000-memory.dmp

Filesize
2.0MB

Download
memory/4996-135-0x0000000000AC0000-0x0000000000CC2000-memory.dmp

Filesize
2.0MB

Download
memory/4996-136-0x0000000000AC0000-0x0000000000CC2000-memory.dmp

Filesize
2.0MB

Download
memory/4996-137-0x0000000000AC0000-0x0000000000CC2000-memory.dmp

Filesize
2.0MB

Download