719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6

Analysis

max time kernel
158s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
Size

3.8MB
MD5

b9215aa2158e1e6f19d40a4265950200
SHA1

c3f8cfd969a555589a28765d21a6512b0b3fe9ab
SHA256

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6
SHA512

4a917701ad8851a083f987b73d070e061b317c14f11fd6d28df47bc3b15bbe05a44dd1206f9850acf8c0d43216b04007f44a28176cabfee34bae2ee1162cdaab
SSDEEP

49152:nVg5tQ7aLT59JH6nS1fc4L6Lek+kZnSlnXFhySLzSzkapTlYF++jfkNl6LvPlcvS:Vg56oH6Ofc4e0+SLh2g++6MOa

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Defender = "\"C:\\ProgramData\\adminSafe.exe\""	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Defender = "\"C:\\ProgramData\\adminSafe.exe\""	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

description	pid	process	target process
PID 4260 set thread context of 3576	4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

pid process

3576 719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

pid	process
3576	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

pid	process
4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

pid	process
4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

description	pid	process	target process
PID 4260 wrote to memory of 3576	4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
PID 4260 wrote to memory of 3576	4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
PID 4260 wrote to memory of 3576	4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
PID 4260 wrote to memory of 3576	4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
PID 4260 wrote to memory of 3576	4260	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe	719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe

C:\Users\Admin\AppData\Local\Temp\719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
"C:\Users\Admin\AppData\Local\Temp\719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260

C:\Users\Admin\AppData\Local\Temp\719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe
"C:\Users\Admin\AppData\Local\Temp\719cde05d356cb1c04ad6fa1d1dfb3102ce367a7557eaccd07e44114fdc096f6.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:3576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-132-0x0000000000000000-mapping.dmp

Download
memory/3576-133-0x0000000000FA0000-0x0000000001326000-memory.dmp

Filesize
3.5MB

Download
memory/3576-134-0x0000000000FA0000-0x0000000001326000-memory.dmp

Filesize
3.5MB

Download
memory/3576-135-0x0000000000FA0000-0x0000000001326000-memory.dmp

Filesize
3.5MB

Download
memory/3576-136-0x0000000000FA0000-0x0000000001326000-memory.dmp

Filesize
3.5MB

Download
memory/3576-137-0x0000000000FA0000-0x0000000001326000-memory.dmp

Filesize
3.5MB

Download