efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.exe
Size

3.2MB
MD5

e3c29afa883531fefeb4f0a393677bab
SHA1

3eea6cd49f5d4833d37b9473a923bd89ef22c618
SHA256

efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836
SHA512

d300614e73981681a93dd63123ecd9a9472a850b8e215cc892cba9b9784a6a1486ffefcb712cdbb4dc24cb36a08412acbde743fbe71be53e63d374fe3248b23d
SSDEEP

98304:HLOsLNSoUq9z7wO42a9pPhWsqDogCbm90gnJ:KsLkBq9z7wdPhw0iPJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5112	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Avira\AntiVir Desktop	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\KasperskyLab	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\K7 Computing\K7TotalSecurity	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Sophos\Sophos Anti-Virus	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5112	4844	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.exe	80
PID 4844 wrote to memory of 5112	4844	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.exe	80
PID 4844 wrote to memory of 5112	4844	efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.exe	80

C:\Users\Admin\AppData\Local\Temp\efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.exe
"C:\Users\Admin\AppData\Local\Temp\efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\is-VIV10.tmp\efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VIV10.tmp\efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp" /SL5="$D0148,2993892,56832,C:\Users\Admin\AppData\Local\Temp\efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.exe"
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  PID:5112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Security Software Discovery

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-VIV10.tmp\efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp

Filesize
693KB

MD5
29a1d516b1a610f003f4e12db49d1927

SHA1
2fd3db50bf7ff75ccc0877166cdda5519a667514

SHA256
1d0993c96603b387d573d2b478c7d752c1defe9e7bfad6fcdf9d4f8d02f48126

SHA512
4f3e69c1d098f02c535296a100ab70d6dae27dd1fdf1dabdc3b706534d5f20d9b78b2505e2241541072326b5a18f881695e491392ca5e496b9ba73e5457891de

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VIV10.tmp\efe69ecfc0e43a46ed10c4b0f272e91b36289967369ddb971a304fca2e9de836.tmp

Filesize
693KB

MD5
29a1d516b1a610f003f4e12db49d1927

SHA1
2fd3db50bf7ff75ccc0877166cdda5519a667514

SHA256
1d0993c96603b387d573d2b478c7d752c1defe9e7bfad6fcdf9d4f8d02f48126

SHA512
4f3e69c1d098f02c535296a100ab70d6dae27dd1fdf1dabdc3b706534d5f20d9b78b2505e2241541072326b5a18f881695e491392ca5e496b9ba73e5457891de

Download Submit
memory/4844-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4844-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4844-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download