fc7872814708660b0005cb6c1f33de7cf8dbb21c70e6bc7d3eaf1e9b07724372

Analysis

max time kernel
202s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Label.exe
Size

107KB
MD5

5470851cd24bdf8381d9b97af6808545
SHA1

ebb3f8b1047ea4f73938cf61ce7e5181bc808075
SHA256

cd95d9bdb757889732abd30d0afed8f64f8cbac8ae7a5e968def054af4e2fcb9
SHA512

4bd530de6421dde4e099c325e4f26afa5355561fb48e2572dc7fd08e4a65e2527a0984a9a9e890b23be1fcbef383c7d5ddf4582c4f5c66bf46a2b770b5542a3f
SSDEEP

1536:jv+KIsl0E7TFu7h3xQ691ky1K6ImYfzaRuBYJBG/c1TaD2huEoJqG1M:T+9GD7kJK6917/S2fJB14kXoL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fgrkhpvd = "\"C:\\Users\\Admin\\AppData\\Local\\birrofwi.exe\""	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Label.exe

pid process

1532 Label.exe
1532 Label.exe

pid	process
1532	Label.exe
1532	Label.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Label.exe

description	pid	process	target process
PID 1532 wrote to memory of 3708	1532	Label.exe	svchost.exe
PID 1532 wrote to memory of 3708	1532	Label.exe	svchost.exe
PID 1532 wrote to memory of 3708	1532	Label.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Label.exe
"C:\Users\Admin\AppData\Local\Temp\Label.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Adds Run key to start application
PID:3708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-132-0x00000000007B0000-0x00000000007C4000-memory.dmp

Filesize
80KB

Download
memory/3708-134-0x0000000000000000-mapping.dmp

Download
memory/3708-135-0x00000000000E0000-0x00000000000EE000-memory.dmp

Filesize
56KB

Download
memory/3708-136-0x0000000000D30000-0x0000000000D41000-memory.dmp

Filesize
68KB

Download
memory/3708-137-0x0000000001550000-0x00000000015D0000-memory.dmp

Filesize
512KB

Download