Analysis
-
max time kernel
173s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 15:38
Static task
static1
Behavioral task
behavioral1
Sample
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe
Resource
win10v2004-20220812-en
General
-
Target
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe
-
Size
120KB
-
MD5
6cb93379756e78187196bfaff65cbb50
-
SHA1
fab8576c9c70f753a32a565ebee60b10d2dac5b8
-
SHA256
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09
-
SHA512
32e887a34f64a649a6587b4813378de6a4ef58f7bb9d737f39dc8f53beebdafd65c8f5b0e64ab53c0418124024fa98ea8d309eb47fd8690c85227c32bf0a4543
-
SSDEEP
3072:IvG7ySV7c2lCECtUeExLBwdJddCJHZlPD4Fx50BNrr5vR:IUc2xQSxydJzCJ5JcGrdR
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Netscape = "C:\\Users\\Admin\\AppData\\Roaming\\cefueugw\\rutuctcv.exe" svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exepid process 4440 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exedescription pid process target process PID 4440 wrote to memory of 4276 4440 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe svchost.exe PID 4440 wrote to memory of 4276 4440 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe svchost.exe PID 4440 wrote to memory of 4276 4440 dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe"C:\Users\Admin\AppData\Local\Temp\dd6ed56287cd25d770aa1de2976a31b2d1065b18b661a0986ab6af4289230a09.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Adds policy Run key to start application
PID:4276
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4276-135-0x0000000000000000-mapping.dmp
-
memory/4276-136-0x0000000000D00000-0x0000000000D13000-memory.dmpFilesize
76KB
-
memory/4276-137-0x0000000000C20000-0x0000000000C2F000-memory.dmpFilesize
60KB
-
memory/4440-132-0x0000000002450000-0x00000000024E5000-memory.dmpFilesize
596KB
-
memory/4440-133-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4440-134-0x0000000000070000-0x000000000007F000-memory.dmpFilesize
60KB