Analysis
-
max time kernel
252s -
max time network
327s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:47
Static task
static1
Behavioral task
behavioral1
Sample
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe
Resource
win10v2004-20221111-en
General
-
Target
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe
-
Size
255KB
-
MD5
aed2c210d8388d109b5e2e50f4c09e1b
-
SHA1
fb9845a0597d7e2f7051a5e000fc1276d2746b15
-
SHA256
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee
-
SHA512
a32bb8df1bd88b042b34fdeca037bc737d02d9bbf2f353caaaed6e5ba335434959b827002c1b1c76d4bf943e972adbda98b74277c157094f4306c9bdbf5a4d6b
-
SSDEEP
6144:ncKreOw1Alj3jJ5teqA63G40ES16UAAEm4:ncKreOw1AlZ5tL3DE6Uhv4
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exedescription ioc process File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\O: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exedescription pid process target process PID 1488 set thread context of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exesvchost.exepid process 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 3644 svchost.exe 3644 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exesvchost.exedescription pid process target process PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1488 wrote to memory of 1568 1488 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1568 wrote to memory of 3644 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1568 wrote to memory of 3644 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1568 wrote to memory of 3644 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1568 wrote to memory of 3644 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1568 wrote to memory of 2156 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1568 wrote to memory of 2156 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1568 wrote to memory of 2156 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1568 wrote to memory of 2156 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1568 wrote to memory of 2156 1568 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 3644 wrote to memory of 1500 3644 svchost.exe notepad.exe PID 3644 wrote to memory of 1500 3644 svchost.exe notepad.exe PID 3644 wrote to memory of 1500 3644 svchost.exe notepad.exe PID 3644 wrote to memory of 1500 3644 svchost.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\SysWOW64\notepad.exe"4⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-132-0x00000000001C0000-0x00000000001D4000-memory.dmpFilesize
80KB
-
memory/1500-138-0x0000000000000000-mapping.dmp
-
memory/1568-133-0x0000000000000000-mapping.dmp
-
memory/1568-134-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1568-139-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2156-137-0x0000000000000000-mapping.dmp
-
memory/3644-136-0x0000000000000000-mapping.dmp
-
memory/3644-140-0x0000000000600000-0x0000000000629000-memory.dmpFilesize
164KB