dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d

Analysis

max time kernel
201s
max time network
68s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe
Size

201KB
MD5

41b29307df1e84747ad2721e6d982185
SHA1

af44ea7f56af393028b47c1c9bc4093e6573ecfb
SHA256

dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d
SHA512

de87b5ad4790b70f21d9d9e67ea20fb27e11d1875b922c3be6b018c712a739dc463e0cd367160e325b7112284e0d5799e164a52ccf40d6e3ce612632505b19d3
SSDEEP

384:H1qGPVEsAUfRbJ7hVu05IULbLEEfk1DDBCofa5SVakiqPl:V9PuCJ7hVZbLBkTI5x0

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\drivers\\svchost.exe"	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

Drops file in Windows directory 1 IoCs

Processes:

dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

description ioc process

File opened for modification C:\WINDOWS\sound.wav dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

description	ioc	process
File opened for modification	C:\WINDOWS\sound.wav	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

pid	process
1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe
1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe

description	pid	process	target process
PID 1768 wrote to memory of 848	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe
PID 1768 wrote to memory of 848	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe
PID 1768 wrote to memory of 848	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe
PID 1768 wrote to memory of 848	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe
PID 1768 wrote to memory of 1832	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe
PID 1768 wrote to memory of 1832	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe
PID 1768 wrote to memory of 1832	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe
PID 1768 wrote to memory of 1832	1768	dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe
"C:\Users\Admin\AppData\Local\Temp\dc09de2d4dfa83cdcff6405304d906654d382b3c6a0adcb485e530ba593b7b0d.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\WINDOWS\sound.wav
2⤵
PID:848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy uniqradar.exe c:\windows\system32\drivers\svchost.exe
2⤵
PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\sound.wav

Filesize
45B

MD5
365875472087f13b3fa3dd3b914012c3

SHA1
c46f66a711167f20fcdbd9121aa05789d009cad0

SHA256
b21b36363fa0845b7f6c333372b77428d21f5fe1bfda9c996b5b73d740286582

SHA512
00d55488c93973cd2d9907cf7581db5ef1cbbb6dcf45602d2c098e53b81015e3c3aba994f5dceb1a0a0bdf278a0324e1714d4a78bb8c7789b867ffe34d153dc7

Download Submit
memory/848-55-0x0000000000000000-mapping.dmp

Download
memory/1768-54-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1832-57-0x0000000000000000-mapping.dmp

Download