7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c.exe
Size

150KB
MD5

9de283575abf0434955bdcff9285432f
SHA1

ce24ba2435c47715f7b74851028e2034b4649832
SHA256

7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c
SHA512

2170c14b753e76ada55402f5e20193cb46d85968e6f10e2e7e5eb6b6ebc519b173b1c3093b16ce2dfc7acad28a730b2c149ec95b34e589b92585b04a29ed4e9f
SSDEEP

3072:xlOqKRuRtYeuHx7lew0xzrJvbX5L/JE6:zOJRuDyx7cw0V1vpxT

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1840	olqbbpyisha.exe
5344	cipypxifioud.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AuthIP Window Event Compatibility = "C:\\Users\\Admin\\AppData\\Roaming\\zznjlfx\\olqbbpyisha.exe"	7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
5344	cipypxifioud.exe
5344	cipypxifioud.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe
1840	olqbbpyisha.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1840	1088	7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c.exe	80
PID 1088 wrote to memory of 1840	1088	7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c.exe	80
PID 1088 wrote to memory of 1840	1088	7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c.exe	80
PID 1840 wrote to memory of 5344	1840	olqbbpyisha.exe	81
PID 1840 wrote to memory of 5344	1840	olqbbpyisha.exe	81
PID 1840 wrote to memory of 5344	1840	olqbbpyisha.exe	81

C:\Users\Admin\AppData\Local\Temp\7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c.exe
"C:\Users\Admin\AppData\Local\Temp\7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Roaming\zznjlfx\olqbbpyisha.exe
  "C:\Users\Admin\AppData\Roaming\zznjlfx\olqbbpyisha.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Users\Admin\AppData\Roaming\zznjlfx\cipypxifioud.exe
    WATCHDOGPROC "C:\Users\Admin\AppData\Roaming\zznjlfx\olqbbpyisha.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\zznjlfx\cipypxifioud.exe

Filesize
150KB

MD5
9de283575abf0434955bdcff9285432f

SHA1
ce24ba2435c47715f7b74851028e2034b4649832

SHA256
7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c

SHA512
2170c14b753e76ada55402f5e20193cb46d85968e6f10e2e7e5eb6b6ebc519b173b1c3093b16ce2dfc7acad28a730b2c149ec95b34e589b92585b04a29ed4e9f

Download Submit
C:\Users\Admin\AppData\Roaming\zznjlfx\cipypxifioud.exe

Filesize
150KB

MD5
9de283575abf0434955bdcff9285432f

SHA1
ce24ba2435c47715f7b74851028e2034b4649832

SHA256
7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c

SHA512
2170c14b753e76ada55402f5e20193cb46d85968e6f10e2e7e5eb6b6ebc519b173b1c3093b16ce2dfc7acad28a730b2c149ec95b34e589b92585b04a29ed4e9f

Download Submit
C:\Users\Admin\AppData\Roaming\zznjlfx\olqbbpyisha.exe

Filesize
150KB

MD5
9de283575abf0434955bdcff9285432f

SHA1
ce24ba2435c47715f7b74851028e2034b4649832

SHA256
7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c

SHA512
2170c14b753e76ada55402f5e20193cb46d85968e6f10e2e7e5eb6b6ebc519b173b1c3093b16ce2dfc7acad28a730b2c149ec95b34e589b92585b04a29ed4e9f

Download Submit
C:\Users\Admin\AppData\Roaming\zznjlfx\olqbbpyisha.exe

Filesize
150KB

MD5
9de283575abf0434955bdcff9285432f

SHA1
ce24ba2435c47715f7b74851028e2034b4649832

SHA256
7e7b9a95ed37ee04ae56fe20c8340edc81e421b80cab24c4b128e607bc7d623c

SHA512
2170c14b753e76ada55402f5e20193cb46d85968e6f10e2e7e5eb6b6ebc519b173b1c3093b16ce2dfc7acad28a730b2c149ec95b34e589b92585b04a29ed4e9f

Download Submit