68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09

Analysis

max time kernel
144s
max time network
156s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
Size

370KB
MD5

a3932cef001086aa4356ce16494e192f
SHA1

89abb63e73d3fe2d53f28969bf386a92edf3268c
SHA256

68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09
SHA512

b16408fc015172232d918032416316dc8b2ab6b0be87a9a22db84bce35e0cfdd3d744e95d25a3ae86d21ccbc985d4eae573dc37095f91f6fe8d06a6531eed85a
SSDEEP

6144:1w4qIcn4zazPjHHMjZnNJ3arEZWMCJoiZ4hw/iwrYq/2b3cjgOx:1wWO7bsjZNJiE04L6YWZjgOx

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdate.exe"	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

description	pid	process	target process
PID 1724 set thread context of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

pid process

1724 68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

pid	process
1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

description	pid	process	target process
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
PID 1724 wrote to memory of 1212	1724	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe	68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe

C:\Users\Admin\AppData\Local\Temp\68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
"C:\Users\Admin\AppData\Local\Temp\68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
C:\Users\Admin\AppData\Local\Temp\68a06bf14a99805d179200cabedb6cf3dfb15a5e177f42319dc1fa987bc62b09.exe
2⤵
- Adds Run key to start application
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-56-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1212-57-0x000000000040AF4A-mapping.dmp

Download
memory/1212-59-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1212-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1212-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download