d9fcaaad08ef061b94fe0ecfa7d607409cc7ee89383a57856bf1b1c726379353

Analysis

max time kernel
155s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DSC01393.exe
Size

6.3MB
MD5

8bf1275aaa6a8988bcc24ce6633e1265
SHA1

625e0cb618cb00be7b1395c066aa58b0a731b7ae
SHA256

2b2fbe2c108d5a752e765417dfdc5d93e30ca24c4ca6925d15dbe3f5129a1ae8
SHA512

b3707cb6d3f7f315c3822285d24816a5d9939cbf52cc0b96addff1e3993e92032131d6c56feba26f9d1d99cee7d32c27a2f64a92a430a9e384b6d46026c7ee1f
SSDEEP

98304:SgenqebzWpF8Kk6gLkAnSJ5ohRskJNNgPNpmOkgl+sHFZZC1zBqouXc:SDnKpFdOwAnSJ5WRsH3mul+Mg9F

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DSC01393.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogin.exe"	DSC01393.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1716 2552 WerFault.exe DSC01393.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

DSC01393.exe

pid process

2552 DSC01393.exe

pid	pid_target	process	target process
1716	2552	WerFault.exe	DSC01393.exe

pid	process
2552	DSC01393.exe

C:\Users\Admin\AppData\Local\Temp\DSC01393.exe
"C:\Users\Admin\AppData\Local\Temp\DSC01393.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 380
2⤵
- Program crash
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2552 -ip 2552
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-132-0x0000000000400000-0x0000000001183D9A-memory.dmp

Filesize
13.5MB

Download