3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
Size

137KB
MD5

c7fc2aeb7a9f0eb0084b0ca3df713888
SHA1

94f3318cf229abbbbc43f64c92d13a9c74f81373
SHA256

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d
SHA512

e9766fafe25c5a6c4f3ff568c13e1f6fe6ef0c7d4282a268494aa49ee5a597e9acaa48fbe8516bad8228498e27fc09f9b7d66188ed6a4fc37d8afc49028ab449
SSDEEP

3072:ccrSP5z8RCgm730aSEJcp9gH7y8BclYlcAYoruR8:RrSP5oRXm74p9R8BclYlcsrI8

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82MUYSOW-FDIB-S53Y-8G4M-86MMMH5RW3A2}	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82MUYSOW-FDIB-S53Y-8G4M-86MMMH5RW3A2}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe\""	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsLive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe"	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	pid	process	target process
PID 1048 set thread context of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

pid process

1048 3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

pid	process
1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

description	pid	process	target process
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
PID 1048 wrote to memory of 1280	1048	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe	3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe

C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
"C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe
  "C:\Users\Admin\AppData\Local\Temp\3bcea9fa1acd45482ce76ee69440f63df7af8132d337aca9489d1d50a6796b2d.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-134-0x0000000000000000-mapping.dmp

Download
memory/1280-135-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1280-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1280-138-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1280-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download