201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
Size

533KB
MD5

01ec019833b037f460f639f57ff46e39
SHA1

207f3390784634816d16991438cff5a0cdb38fcd
SHA256

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8
SHA512

5c4054cfcc616efb8a5531784a94a2cf4def1466bcc58a786d6a1bf9d1d5193d23e202b5bbc3e17ddee1f31c6bd78e4280a7b7b3738904cf80085785539a9e25
SSDEEP

6144:l4p+VmgaO8J90qMg8uEnU1RnS+HRXrh0669jvjfWM+CN4DTW0n/T+QNWmNb:iQVUXKZJjn+CN4DTW0n/T+QNWmN

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wnd32 = "C:\\Program Files\\Wnd32\\RtHDVCpl.exe"	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

Drops file in Program Files directory 2 IoCs

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	ioc	process
File created	C:\Program Files\Wnd32\RtHDVCpl.exe	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
File opened for modification	C:\Program Files\Wnd32\	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	pid	process
Token: SeDebugPrivilege	1960	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
Token: 33	1960	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
Token: SeIncBasePriorityPrivilege	1960	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

C:\Users\Admin\AppData\Local\Temp\201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
"C:\Users\Admin\AppData\Local\Temp\201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-54-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Filesize
10.1MB

Download
memory/1960-55-0x000007FEF2BB0000-0x000007FEF3C46000-memory.dmp

Filesize
16.6MB

Download