b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe
Size

76KB
MD5

adbeb22fb0476aa360c6481aa5bdf578
SHA1

d976d4d60333e3443f12f8fd1b4ecd8ce9664fe7
SHA256

b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa
SHA512

d4b3f9e7cfc16b77e05a5f787c5d443f8ce2537a2fc9792e6a426c053547bdcdf4c627f847a5b3f16e65f857a6b624186392207db33b076ffe000550efc69128
SSDEEP

768:tFqolaDUg/MKQGHn4VuUqVR8l8WXJUj2osGcm9Thmc4vdfLwUWHy24c0D7suBxPO:n3LFG7wR5UjjcNcOfLwUWP4wJd

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5028	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SVCSHOST = "C:\\progra~1\\Common Files\\svchost.exe"	b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\progra~1\Common Files\svchost.exe	b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe
File opened for modification	C:\progra~1\Common Files\svchost.exe	b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 5028	5080	b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe	82
PID 5080 wrote to memory of 5028	5080	b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe	82
PID 5080 wrote to memory of 5028	5080	b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe	82

C:\Users\Admin\AppData\Local\Temp\b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe
"C:\Users\Admin\AppData\Local\Temp\b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5080
- C:\progra~1\Common Files\svchost.exe
  "C:\progra~1\Common Files\svchost.exe"
  2⤵
  - Executes dropped EXE
  PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\svchost.exe

Filesize
76KB

MD5
adbeb22fb0476aa360c6481aa5bdf578

SHA1
d976d4d60333e3443f12f8fd1b4ecd8ce9664fe7

SHA256
b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa

SHA512
d4b3f9e7cfc16b77e05a5f787c5d443f8ce2537a2fc9792e6a426c053547bdcdf4c627f847a5b3f16e65f857a6b624186392207db33b076ffe000550efc69128

Download Submit
C:\progra~1\Common Files\svchost.exe

Filesize
76KB

MD5
adbeb22fb0476aa360c6481aa5bdf578

SHA1
d976d4d60333e3443f12f8fd1b4ecd8ce9664fe7

SHA256
b397b04627526de096d29921120a3ab7137374bca89f4ae783dc5c470e5e66aa

SHA512
d4b3f9e7cfc16b77e05a5f787c5d443f8ce2537a2fc9792e6a426c053547bdcdf4c627f847a5b3f16e65f857a6b624186392207db33b076ffe000550efc69128

Download Submit