c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e

Analysis

max time kernel
293s
max time network
355s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:18

Target

c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e.exe
Size

76KB
MD5

709db8d8918d4c2e7fe4800763fe2c72
SHA1

95eee5d018932ff6c97bd42bb84d1e94a11813aa
SHA256

c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e
SHA512

06e6c8371047055b5b2310d2d3cfced6858bf8b6a6ae00bfc72ad85620f28476ff72200f788410968e8728b2d5d3166370fd953862cc97c8bb512adfb52562b1
SSDEEP

1536:H/ex+N3DHTeOGSUd2X1uORZ7l4PBZMA5nXOo6YR9MbUHli:H/eg1efcxp4pZMAlXOo6YR2IHli

Score

8^/10

discovery

Executes dropped EXE 1 IoCs

Processes:

edg86D5.exe

pid process

3112 edg86D5.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
3112	edg86D5.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e.exe

description	pid	process	target process
PID 1832 wrote to memory of 3112	1832	c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e.exe	edg86D5.exe
PID 1832 wrote to memory of 3112	1832	c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e.exe	edg86D5.exe
PID 1832 wrote to memory of 3112	1832	c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e.exe	edg86D5.exe

C:\Users\Admin\AppData\Local\Temp\c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e.exe
"C:\Users\Admin\AppData\Local\Temp\c9d96cd32175f66352bf1c7b6ae0a5144873a0fc28543c73d3f2d7f40228327e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\edg86D5.exe
C:\Users\Admin\AppData\Local\edg86D5.exe C:\Users\Admin\AppData\Local\Temp\C9D96C~1.EXE cp
2⤵
- Executes dropped EXE
PID:3112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Local\edg86D5.exe
Filesize
76KB

MD5
0811ec8aa58c20099473b276503452b1

SHA1
a69aa60b4d72eb1a8e190c9fc3faf1b3b81cba3a

SHA256
33d76f64587a44872e218eec96d1ac827729bcdcf57b357094a9b2ca6afa68a0

SHA512
66d0815ccac25cf17d85f711cf7754f7a5996a24e101b65c2fcc0e399f90ff0dc4f160fadc8dfdf1b9ed01416212ea435436e1ee10d84e375791b4085ab49527

Download Submit
memory/1832-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3112-138-0x0000000000000000-mapping.dmp

Download