72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887

Analysis

max time kernel
170s
max time network
186s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe
Size

84KB
MD5

929ac99bc92c6915e6c1bb691792edf8
SHA1

2db287f41c327ed16f39abf16285daa82276822c
SHA256

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887
SHA512

4ffcb46700a2dad60b8ed011365eeaaefc7d8a006f76f0e2c4d11bc260d59941a30c699372379808e69b99e49c33c294945e987544ee7249c3d6d5e7cc59fae4
SSDEEP

1536:knQq6GgBTb7rDWSILUcMET/GfhjC1pV3mAxCgvtI:2QqavrrILUcCjMprxCgvtI

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\portcdn.exe = "C:\\Program Files (x86)\\WinPcap\\portcdn.exe"	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

Drops file in Program Files directory 2 IoCs

Processes:

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description	ioc	process
File created	C:\Program Files (x86)\WinPcap\portcdn.exe	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe
File opened for modification	C:\Program Files (x86)\WinPcap\portcdn.exe	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description pid process

Token: SeDebugPrivilege 316 72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description	pid	process
Token: SeDebugPrivilege	316	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

C:\Users\Admin\AppData\Local\Temp\72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe
"C:\Users\Admin\AppData\Local\Temp\72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-54-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download