023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0

Analysis

max time kernel
158s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.exe
Size

3.2MB
MD5

3fa98565f560e5b663105cbf77507fef
SHA1

c1cc91f8100a794cd26b18ce3e349360fd61ac3c
SHA256

023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0
SHA512

5c833b8ca7b2f89ea11e80ead945b6e2490b69e1d700d62db167f8d8594320e35f37271775a2bdb89ca7e2f6897175df7b91a7d67457263399350f19084eb51a
SSDEEP

49152:79VfNQq914PM7T1+OcoBixiZ6DRoG3jSrH9wpEaoufBpdNbNrBYWqfQbKzUw+n1F:Brh4U7T1+BoBiuGjmHuC8LlNrB1KaNGq

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4052	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Avira\AntiVir Desktop	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\KasperskyLab	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\K7 Computing\K7TotalSecurity	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Sophos\Sophos Anti-Virus	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 4052	740	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.exe	84
PID 740 wrote to memory of 4052	740	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.exe	84
PID 740 wrote to memory of 4052	740	023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.exe	84

C:\Users\Admin\AppData\Local\Temp\023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.exe
"C:\Users\Admin\AppData\Local\Temp\023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\is-A1NCT.tmp\023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A1NCT.tmp\023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp" /SL5="$C014A,2996268,52736,C:\Users\Admin\AppData\Local\Temp\023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.exe"
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  PID:4052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Security Software Discovery

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-A1NCT.tmp\023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp

Filesize
691KB

MD5
de000488dcab219819be7899d4977241

SHA1
671ca8da2a33354e6a411933eb48e6af3d0d0237

SHA256
673803887d8080de86333514768bd113586cb42baabd88536d8ee37f037ad995

SHA512
be7eb164c1b47eee40437279797e7c793f493bbe25c18d680c00fab18900829cd4e0cd9cc075a5e072a83c500227d920ed5c25ddd83a0ee911e8dd4b87010973

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-A1NCT.tmp\023ca460fe994a4a6e80044b230b65edb4676280e3246d56e560b0e83d3672f0.tmp

Filesize
691KB

MD5
de000488dcab219819be7899d4977241

SHA1
671ca8da2a33354e6a411933eb48e6af3d0d0237

SHA256
673803887d8080de86333514768bd113586cb42baabd88536d8ee37f037ad995

SHA512
be7eb164c1b47eee40437279797e7c793f493bbe25c18d680c00fab18900829cd4e0cd9cc075a5e072a83c500227d920ed5c25ddd83a0ee911e8dd4b87010973

Download Submit
memory/740-132-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/740-136-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/740-137-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download