865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f

Analysis

max time kernel
246s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe
Size

44KB
MD5

7c3c70263a72dca219905eaa13fb17be
SHA1

4756592ef37a2209985e7708a79d69ca430a58b5
SHA256

865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f
SHA512

c87215373e5c68757c713892cd3860ccc8464d0b5d7733c46e4e3cef2db0faa51931a581b7b220c3f72a7b1ddda091d424e34fb14057f1207b97abdc99cfa6f5
SSDEEP

768:Wajf3OJMzNp5p3hs0qLVwRO/YAtGxmPPmHnad3u9gDl:Bjf3O4txrq5w+t+6d3vl

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mozilla = "C:\\Users\\Admin\\AppData\\Roaming\\BB049B.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1876 svchost.exe

pid	process
1876	svchost.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe

pid	process
468	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe
468	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe

description	pid	process	target process
PID 468 wrote to memory of 1876	468	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe	svchost.exe
PID 468 wrote to memory of 1876	468	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe	svchost.exe
PID 468 wrote to memory of 1876	468	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe	svchost.exe
PID 468 wrote to memory of 1876	468	865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe
"C:\Users\Admin\AppData\Local\Temp\865693bda29fa599c456e10c24d16deebf83a6b17894f8d2f19668b94166b32f.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Adds policy Run key to start application
- Deletes itself
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/468-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/468-57-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1876-56-0x0000000000000000-mapping.dmp

Download
memory/1876-58-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1876-59-0x00000000008A0000-0x00000000008A8000-memory.dmp

Filesize
32KB

Download
memory/1876-60-0x0000000000080000-0x0000000000084000-memory.dmp

Filesize
16KB

Download
memory/1876-61-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/1876-62-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download