5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60

Analysis

max time kernel
135s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe
Size

24KB
MD5

0cb6127caa55e3ff2b68d3d344b6903c
SHA1

e5326bb340523f54dd201c9b09cdc44b9767339c
SHA256

5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60
SHA512

1c29e9101142d3fc8beef3eda2a3cd30d46240c880665a1bba123b611f0fa8e32ee2e79f55792acc5ec626e3a3f531dc6a13db22208627c825ae76efae0f6404
SSDEEP

384:u9TydOFPhoV6o/zz0r713G7SSevuvAmqk4W21IJ0Tm7rJwaMT9R:EAO9YN23G7zymqk721i7OT9

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1296 svchost.exe

pid	process
1296	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Name = "\"C:\\Users\\Admin\\AppData\\Local\\csrss.exe\""	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe

pid	process
1752	5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe
1752	5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe

description	pid	process	target process
PID 1752 wrote to memory of 1296	1752	5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe	svchost.exe
PID 1752 wrote to memory of 1296	1752	5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe	svchost.exe
PID 1752 wrote to memory of 1296	1752	5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe	svchost.exe
PID 1752 wrote to memory of 1296	1752	5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe
"C:\Users\Admin\AppData\Local\Temp\5393dd11c7afdf6854860bde16ba071778be45118c9f539032ac41fefdcf2e60.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Deletes itself
- Adds Run key to start application
PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-54-0x0000000000000000-mapping.dmp

Download
memory/1296-56-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1296-57-0x0000000000ED0000-0x0000000000ED8000-memory.dmp

Filesize
32KB

Download
memory/1296-58-0x00000000000C0000-0x00000000000C4000-memory.dmp

Filesize
16KB

Download
memory/1752-55-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download