201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
Size

533KB
MD5

01ec019833b037f460f639f57ff46e39
SHA1

207f3390784634816d16991438cff5a0cdb38fcd
SHA256

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8
SHA512

5c4054cfcc616efb8a5531784a94a2cf4def1466bcc58a786d6a1bf9d1d5193d23e202b5bbc3e17ddee1f31c6bd78e4280a7b7b3738904cf80085785539a9e25
SSDEEP

6144:l4p+VmgaO8J90qMg8uEnU1RnS+HRXrh0669jvjfWM+CN4DTW0n/T+QNWmNb:iQVUXKZJjn+CN4DTW0n/T+QNWmN

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wnd32 = "C:\\Program Files\\Wnd32\\RtHDVCpl.exe"	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

Drops file in Program Files directory 2 IoCs

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	ioc	process
File created	C:\Program Files\Wnd32\RtHDVCpl.exe	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
File opened for modification	C:\Program Files\Wnd32\	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

Drops file in Windows directory 3 IoCs

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
File opened for modification	C:\Windows\assembly	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

description	pid	process
Token: SeDebugPrivilege	3064	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
Token: 33	3064	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
Token: SeIncBasePriorityPrivilege	3064	201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe

C:\Users\Admin\AppData\Local\Temp\201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe
"C:\Users\Admin\AppData\Local\Temp\201dbaa75968dfc7e008f4e7861ccdf55cf693698828e2717d2d81030c001dc8.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-132-0x00007FFA481A0000-0x00007FFA48BD6000-memory.dmp

Filesize
10.2MB

Download