72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887

Analysis

max time kernel
180s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe
Size

84KB
MD5

929ac99bc92c6915e6c1bb691792edf8
SHA1

2db287f41c327ed16f39abf16285daa82276822c
SHA256

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887
SHA512

4ffcb46700a2dad60b8ed011365eeaaefc7d8a006f76f0e2c4d11bc260d59941a30c699372379808e69b99e49c33c294945e987544ee7249c3d6d5e7cc59fae4
SSDEEP

1536:knQq6GgBTb7rDWSILUcMET/GfhjC1pV3mAxCgvtI:2QqavrrILUcCjMprxCgvtI

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\portcdn.exe = "C:\\Program Files (x86)\\WinPcap\\portcdn.exe"	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

Drops file in Program Files directory 2 IoCs

Processes:

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description	ioc	process
File created	C:\Program Files (x86)\WinPcap\portcdn.exe	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe
File opened for modification	C:\Program Files (x86)\WinPcap\portcdn.exe	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description pid process

Token: SeDebugPrivilege 368 72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

description	pid	process
Token: SeDebugPrivilege	368	72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe

C:\Users\Admin\AppData\Local\Temp\72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe
"C:\Users\Admin\AppData\Local\Temp\72303f1f563b16e5ecbd30a5473a9ff3db80f26b4fa84362171c93e8f2473887.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads