9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d

Analysis

max time kernel
67s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe
Size

646KB
MD5

a7bf7b4897796f306eadabbbcea66c66
SHA1

722e57cc1e49d5f89fa8753c2fca9e4637a61aab
SHA256

9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d
SHA512

049af3fde6db2da397a2ed96098b58caf40d51f40be8e200a29e0e71c17c85eb6847983ad8c1137e512396e5a8e524bf9b04ebcbe0262fe8fa5acfc2ce5be1c2
SSDEEP

12288:ffARt1yY65cAP5l7wGewGV14MsnGHhbUBatlXq:3AT1yYmRpeX14/S5UB

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\DeviceSetupManager = "\"C:\\Users\\Admin\\AppData\\Roaming\\B45M0QWTJ1F6HEK3\\Zobim\\Product Version\\DsmSVc\""	9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1112	992	9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe	28
PID 992 wrote to memory of 1112	992	9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe	28
PID 992 wrote to memory of 1112	992	9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe	28
PID 992 wrote to memory of 1112	992	9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe	28

C:\Users\Admin\AppData\Local\Temp\9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe
"C:\Users\Admin\AppData\Local\Temp\9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe
  C:\Users\Admin\AppData\Local\Temp\9c1ada96c0e876b99c0cb4bc9825d66aae3a57be5b5bfce7b97ed2b665f0e63d.exe
  2⤵
  PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/992-55-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/992-56-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download
memory/992-57-0x0000000074F50000-0x00000000754FB000-memory.dmp

Filesize
5.7MB

Download