Analysis

  • max time kernel
    201s
  • max time network
    212s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 11:57

General

  • Target

    69c2a01ab0f4ecab971359f17daffc773281e5e9b7f8050e097b5d2d99cc564b.exe

  • Size

    822KB

  • MD5

    d4b72394245cc6556197234f8f4b1057

  • SHA1

    098d9f2e77b8685e4abc810adecf2ef05b498c48

  • SHA256

    69c2a01ab0f4ecab971359f17daffc773281e5e9b7f8050e097b5d2d99cc564b

  • SHA512

    5587776eb283d1e955ede2b70aecaf50866c5bcbf9727cb2fd6593a273d360fd4640e69922c941591cfe573748c32e5e96bdb3df0d9c2551527dcdb80127da2b

  • SSDEEP

    12288:H/1fYubjfwUQEjEj5O5fqRk9ZJbV7osjVugoX3C5CJLb4JnJihm+08/MmgPCL6m3:H/1fXXobOlxV/uG5TB8EDe6mL5hD

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies registry class 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69c2a01ab0f4ecab971359f17daffc773281e5e9b7f8050e097b5d2d99cc564b.exe
    "C:\Users\Admin\AppData\Local\Temp\69c2a01ab0f4ecab971359f17daffc773281e5e9b7f8050e097b5d2d99cc564b.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4440

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4440-132-0x0000000002FD0000-0x0000000003152000-memory.dmp

    Filesize

    1.5MB

  • memory/4440-139-0x0000000002FD0000-0x0000000003152000-memory.dmp

    Filesize

    1.5MB

  • memory/4440-140-0x0000000002FD0000-0x0000000003152000-memory.dmp

    Filesize

    1.5MB

  • memory/4440-141-0x0000000002FD0000-0x0000000003152000-memory.dmp

    Filesize

    1.5MB