cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe
Size

25KB
MD5

ec42a00427ce86560df49f3d6ff6386f
SHA1

cfe5e997295198f8263d2c0430c2d8339a5317ea
SHA256

cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87
SHA512

7e92c553c29f492123e2674add43179f8c6600606e95914ad3abd90c43d12761c8d5b5eb47e5e3f539a247e1d62df7d6b2c169c6e8e412faeea09a30b6cb0eaa
SSDEEP

384:lcwznVKyqCvPSryiZzKNlExwFIXprxrILQY/1NXB2qmZ5IuPipMuS6jPR2B:uQnwfCy7xUUprBUQUBaZ6MhB6m

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3588-133-0x0000000031420000-0x000000003142B000-memory.dmp	upx
behavioral2/memory/3588-136-0x0000000031420000-0x000000003142B000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
3588	cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe
3588	cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dorzfy.exe"	cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe

C:\Users\Admin\AppData\Local\Temp\cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe
"C:\Users\Admin\AppData\Local\Temp\cdefddda9505ee87f105c9db3a85775a0fb72ab34b35a14fc0dcae7d98111d87.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eli7331.tmp

Filesize
172KB

MD5
4df9d649a9ca57012a27a979d8fac33a

SHA1
9c462e8b61ae462c8a6c3b1e3420e304cc9237b8

SHA256
acb8a1fb748801aab643b55c48452e69fc75fcd84c8d554b49f1503ad8554121

SHA512
698d65f9b15b79818ffb202a69cae31e9eea7a35b165c329787c6d0aee375d0b29e892adb00fb730679dfbd90c15ee6f4628b3aeedc300eda35c6e01d1448b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\eli7331.tmp

Filesize
172KB

MD5
4df9d649a9ca57012a27a979d8fac33a

SHA1
9c462e8b61ae462c8a6c3b1e3420e304cc9237b8

SHA256
acb8a1fb748801aab643b55c48452e69fc75fcd84c8d554b49f1503ad8554121

SHA512
698d65f9b15b79818ffb202a69cae31e9eea7a35b165c329787c6d0aee375d0b29e892adb00fb730679dfbd90c15ee6f4628b3aeedc300eda35c6e01d1448b0e

Download Submit
memory/3588-133-0x0000000031420000-0x000000003142B000-memory.dmp

Filesize
44KB

Download
memory/3588-135-0x0000000002180000-0x00000000021F4000-memory.dmp

Filesize
464KB

Download
memory/3588-136-0x0000000031420000-0x000000003142B000-memory.dmp

Filesize
44KB

Download