7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe
Size

471KB
MD5

9d016e3c7d2ccf3bad8525a90d733a1d
SHA1

12a10c990759613b75289f90614b2a40ac1e51e6
SHA256

7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2
SHA512

f57c4491c75048b30218afca5f317060f04d9924a8790a06e639b3ce28b209d0ff7207b036d23c4ef217824cf7c2d37011172bf6713deb9777c7225fd7c3cef8
SSDEEP

6144:/w2A+4hP2275ELjiT3bPU48Wpxsk/9k8R3rNUru6X1JtFZ+rEMsT:/YLuGDowxBPJpUa6FrFErVsT

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

alter.exe

pid process

2164 alter.exe

pid	process
2164	alter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

alter.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	alter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\alter.exe"	alter.exe

Drops file in Windows directory 2 IoCs

Processes:

7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exealter.exe

description	ioc	process
File opened for modification	C:\Windows\7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.INI	7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe
File opened for modification	C:\Windows\alter.INI	alter.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

alter.exe

pid process

2164 alter.exe
2164 alter.exe
2164 alter.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2248
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

alter.exe

pid process

2164 alter.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

description pid process

Token: SeDebugPrivilege 2248

pid	process
2164	alter.exe
2164	alter.exe
2164	alter.exe

pid	process
2248

pid	process
2164	alter.exe

description	pid	process
Token: SeDebugPrivilege	2248

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exealter.exe

pid	process
3488	7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe
3488	7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe
2164	alter.exe
2164	alter.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe

description	pid	process	target process
PID 3488 wrote to memory of 2164	3488	7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe	alter.exe
PID 3488 wrote to memory of 2164	3488	7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe	alter.exe
PID 3488 wrote to memory of 2164	3488	7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe	alter.exe

C:\Users\Admin\AppData\Local\Temp\7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe
"C:\Users\Admin\AppData\Local\Temp\7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488

C:\Users\Admin\AppData\Local\alter.exe
C:\Users\Admin\AppData\Local\Temp\7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\alter.exe

Filesize
471KB

MD5
9d016e3c7d2ccf3bad8525a90d733a1d

SHA1
12a10c990759613b75289f90614b2a40ac1e51e6

SHA256
7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2

SHA512
f57c4491c75048b30218afca5f317060f04d9924a8790a06e639b3ce28b209d0ff7207b036d23c4ef217824cf7c2d37011172bf6713deb9777c7225fd7c3cef8

Download Submit
C:\Users\Admin\AppData\Local\alter.exe

Filesize
471KB

MD5
9d016e3c7d2ccf3bad8525a90d733a1d

SHA1
12a10c990759613b75289f90614b2a40ac1e51e6

SHA256
7922e1296d28c007daca645f47b5193e0ee006fb53de04953ca7fbebbb32ead2

SHA512
f57c4491c75048b30218afca5f317060f04d9924a8790a06e639b3ce28b209d0ff7207b036d23c4ef217824cf7c2d37011172bf6713deb9777c7225fd7c3cef8

Download Submit
memory/2164-134-0x0000000000000000-mapping.dmp

Download
memory/2164-140-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2164-141-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2164-144-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2248-142-0x0000000002C00000-0x0000000002C35000-memory.dmp

Filesize
212KB

Download
memory/2248-143-0x0000000002C40000-0x0000000002C7B000-memory.dmp

Filesize
236KB

Download
memory/2248-145-0x0000000002A00000-0x0000000002A3B000-memory.dmp

Filesize
236KB

Download
memory/3488-132-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3488-137-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download