01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182

Analysis

max time kernel
155s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.exe
Size

2.5MB
MD5

9155b243973dd3b0a97a3847bf4bb040
SHA1

e71f93e3c261767f32a7abe92b0c471319776e25
SHA256

01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182
SHA512

c570ea9cd494d3439737fd144184f14ba16c678010dc834ea627a1d2b71e15d4871143f40204c7815b35d46ea6b4f8712b9d746a4f10cbb6bd29b1b056f93bf7
SSDEEP

49152:C98b4rCZlHNxlC1JUv7cPao0vVOH9LNfl+VUgaW2mGIMEDxF+GSDk0xdyyr:MDCZZ/lC1JUvgPv8OdxoVaW2mGIMGxgv

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4284	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\KasperskyLab	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\K7 Computing\K7TotalSecurity	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Sophos\Sophos Anti-Virus	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Avira\AntiVir Desktop	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4284	1624	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.exe	83
PID 1624 wrote to memory of 4284	1624	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.exe	83
PID 1624 wrote to memory of 4284	1624	01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.exe	83

C:\Users\Admin\AppData\Local\Temp\01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.exe
"C:\Users\Admin\AppData\Local\Temp\01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\is-4940V.tmp\01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4940V.tmp\01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp" /SL5="$B0066,2317042,56832,C:\Users\Admin\AppData\Local\Temp\01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.exe"
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  PID:4284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Security Software Discovery

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-4940V.tmp\01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp

Filesize
693KB

MD5
29a1d516b1a610f003f4e12db49d1927

SHA1
2fd3db50bf7ff75ccc0877166cdda5519a667514

SHA256
1d0993c96603b387d573d2b478c7d752c1defe9e7bfad6fcdf9d4f8d02f48126

SHA512
4f3e69c1d098f02c535296a100ab70d6dae27dd1fdf1dabdc3b706534d5f20d9b78b2505e2241541072326b5a18f881695e491392ca5e496b9ba73e5457891de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4940V.tmp\01c4d95de25f68b4081db7bdd12b789a24161eac618b9d77ff92919e14eaf182.tmp

Filesize
693KB

MD5
29a1d516b1a610f003f4e12db49d1927

SHA1
2fd3db50bf7ff75ccc0877166cdda5519a667514

SHA256
1d0993c96603b387d573d2b478c7d752c1defe9e7bfad6fcdf9d4f8d02f48126

SHA512
4f3e69c1d098f02c535296a100ab70d6dae27dd1fdf1dabdc3b706534d5f20d9b78b2505e2241541072326b5a18f881695e491392ca5e496b9ba73e5457891de

Download Submit
memory/1624-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1624-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1624-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download