9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e

Analysis

max time kernel
10s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
Size

310KB
MD5

4abf84df7c45e9601b0e10e55fa86f90
SHA1

796de564727eadc74debd85ebd5bd8f7018e5102
SHA256

9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e
SHA512

42ba66fa58ece29d35bfd466a2830b3482b03d5a7f3d61f972f799d668cde672f46b109ec7dfdf0f1a7812d84a595f175dbb8f8b4f57deb54093635e2abf9b80
SSDEEP

3072:mUdghqnq3VAWdg2vedrAsnJT2S2RAbVJ/pUhbqXoSnNQNvvPxcwr73lwjdrh8fd5:mUAqq3VAWdHm56SiwybqveHC3Z+Qup5

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe"	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe

Drops file in System32 directory 2 IoCs

Processes:

9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Serverx.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
File opened for modification	C:\Windows\SysWOW64\Serverx.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe

description	pid	process	target process
PID 1992 wrote to memory of 2040	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
PID 1992 wrote to memory of 2040	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
PID 1992 wrote to memory of 2040	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
PID 1992 wrote to memory of 2040	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
PID 1992 wrote to memory of 2040	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
PID 1992 wrote to memory of 2040	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
PID 1992 wrote to memory of 2040	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
PID 1992 wrote to memory of 1376	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	Explorer.EXE
PID 1992 wrote to memory of 1376	1992	9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
"C:\Users\Admin\AppData\Local\Temp\9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe
"C:\Users\Admin\AppData\Local\Temp\9cf1e44cebc2f08bbc57ace9e34085512515d48b111d579224635490d32bff6e.exe"
3⤵
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-59-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/1992-54-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1992-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1992-61-0x0000000000380000-0x00000000003D2000-memory.dmp

Filesize
328KB

Download
memory/1992-62-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2040-56-0x0000000000000000-mapping.dmp

Download
memory/2040-58-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download