Analysis
-
max time kernel
178s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:40
Static task
static1
Behavioral task
behavioral1
Sample
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe
Resource
win10v2004-20220812-en
General
-
Target
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe
-
Size
256KB
-
MD5
710d5a3a4528ceeb2a58b61eb4aea9cc
-
SHA1
494a8f52506fef62e557d255296384257391e58a
-
SHA256
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2
-
SHA512
c4ab44712465e224381d23704d95b5b1ad6e41a2704999dd1ae838c5b6553331cf1e48de349e9976d1c8c7175ab183d69ba7b8dc7033c2fac2c70570a9477a66
-
SSDEEP
6144:W5abRA2qukF6JUxN127/8ZyOpMSQ5ufkdTb4y8OEezR0cyp5uTO0:W5uZgN1BZppc5uMRb4yyUR7CuZ
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exeexplorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a134133.exe explorer.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
explorer.exe73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a134133 = "C:\\Users\\Admin\\AppData\\Roaming\\a134133.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*134133 = "C:\\Users\\Admin\\AppData\\Roaming\\a134133.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a13413 = "C:\\a134133\\a134133.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*13413 = "C:\\a134133\\a134133.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exedescription pid process target process PID 4884 set thread context of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exepid process 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exeexplorer.exepid process 4136 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 4812 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exepid process 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exeexplorer.exedescription pid process target process PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4884 wrote to memory of 4136 4884 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe PID 4136 wrote to memory of 4812 4136 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe explorer.exe PID 4136 wrote to memory of 4812 4136 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe explorer.exe PID 4136 wrote to memory of 4812 4136 73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe explorer.exe PID 4812 wrote to memory of 1056 4812 explorer.exe svchost.exe PID 4812 wrote to memory of 1056 4812 explorer.exe svchost.exe PID 4812 wrote to memory of 1056 4812 explorer.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe"C:\Users\Admin\AppData\Local\Temp\73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exeC:\Users\Admin\AppData\Local\Temp\73427ef94cc8de9cc39cdb92fa47bc99a11b64940a2aca9af653216196cc88c2.exe2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵PID:1056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-138-0x0000000000000000-mapping.dmp
-
memory/1056-139-0x0000000001000000-0x000000000102B000-memory.dmpFilesize
172KB
-
memory/4136-132-0x0000000000000000-mapping.dmp
-
memory/4136-133-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4136-134-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4136-136-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4812-135-0x0000000000000000-mapping.dmp
-
memory/4812-137-0x0000000000BC0000-0x0000000000BEB000-memory.dmpFilesize
172KB