32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4

Analysis

max time kernel
182s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
Size

121KB
MD5

f02633349374209a5974f5095add5f46
SHA1

fcdf35cb967f3bf96b2cc99e4a8deb0874853ff5
SHA256

32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4
SHA512

0db27919d9fa02f73297a515b8bc3577fc1975c679a5da598eac2959a647c2bd64b75fa5b1c2ef7a86fad57c044170116099bb8024ebf2805d17d0700d0f66dd
SSDEEP

3072:9X3ujCPlXF/mIUJhuyuiAZfyWD5w63aFxsJ:d5lXB56WDqxK

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftStCnt = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe\""	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

description	pid	process	target process
PID 2180 set thread context of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

pid	process
2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

description	pid	process	target process
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
PID 2180 wrote to memory of 1468	2180	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe	32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe

C:\Users\Admin\AppData\Local\Temp\32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
"C:\Users\Admin\AppData\Local\Temp\32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe
"C:\Users\Admin\AppData\Local\Temp\32add1ddc96f956cec62987a42a6c6a96b7350ca5b7eb1df5300ed3a814131f4.exe"
2⤵
- Adds Run key to start application
PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-132-0x0000000000000000-mapping.dmp

Download
memory/1468-133-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1468-135-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1468-136-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download