Analysis

  • max time kernel
    144s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 15:36

General

  • Target

    95e20583c5091fa276324db401d9388ceddbe53f91c6df322a48ed52cc6be56c.exe

  • Size

    323KB

  • MD5

    e434148baab9257518eed55453ddba0e

  • SHA1

    042ae07d2b2bf1051be33836f7aeb91dbd9fade2

  • SHA256

    95e20583c5091fa276324db401d9388ceddbe53f91c6df322a48ed52cc6be56c

  • SHA512

    e7f55225db8fa375726b273c8e4e5f4505fa0c2cef2d5ef7cc6069e9c045e462b7e894d5e079346d63fd53e11481709771bd5adbc3d2071e98e4b87bc53ef574

  • SSDEEP

    6144:MRAhhJxX7bNIKTQ/arynv1oBcSvOxLp+QvnPIFBuTkuW4SWPhlL:UsAL/WUv0cSGx8QvAuxW+lL

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95e20583c5091fa276324db401d9388ceddbe53f91c6df322a48ed52cc6be56c.exe
    "C:\Users\Admin\AppData\Local\Temp\95e20583c5091fa276324db401d9388ceddbe53f91c6df322a48ed52cc6be56c.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Windows\svchost.exe
      C:\Windows\svchost.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Modifies registry class
      PID:856

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchost.exe

    Filesize

    324KB

    MD5

    bd480ee2200396dbbe9ca83e3015e994

    SHA1

    b2728c39b55c557ca18efbcad004493cc3f49675

    SHA256

    64acd18d39e784f98670f165af92c62749c341182ccfcdf5b1ea9a6f16ce8ca7

    SHA512

    7941229c05e5d0f4c5435ae191232ac40c0f8e0fbdcbab0c532a4149ee5db8b866a7334b13d237323d50d90948df385635f4f9646ec4c2a8952e62827e46fffc

  • memory/620-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/620-56-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/856-55-0x0000000000000000-mapping.dmp

  • memory/856-58-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/856-59-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB