a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f

Analysis

max time kernel
198s
max time network
234s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe
Size

93KB
MD5

0eef91ce5ad9e7f6e1c25c681fb34586
SHA1

0b96596cee958d52c928a8e82e69ad15eaf8fc92
SHA256

a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f
SHA512

e08606e769c6c14177421fbe3e43ba479162ad8c5cf3a6248afc1da67f082d996314ed48ba8611e23494ba0a0994b9b807905fe5a5bb2332a426d80d9fb3c2b4
SSDEEP

1536:sADWm7KxPVuw7JU2epOu0KxAPDcOz1sBvHeUT1ANKLDBx:s+OHK4cOza5+UT2w

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Winsds8 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\Winsds8.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winsds8 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-1861771\\Winsds8.exe"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 216 set thread context of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe
216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe
216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe
216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3756	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 216 wrote to memory of 2600	216	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	84
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85
PID 2600 wrote to memory of 3756	2600	a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe	85

C:\Users\Admin\AppData\Local\Temp\a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe
"C:\Users\Admin\AppData\Local\Temp\a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe
  "C:\Users\Admin\AppData\Local\Temp\a47b360ae5c16ae70ba292f82897d9077618440ef68d30d2f63446da4d2e5b1f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: RenamesItself
    PID:3756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-137-0x0000000000460000-0x0000000000465000-memory.dmp

Filesize
20KB

Download
memory/2600-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2600-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3756-140-0x0000000000750000-0x0000000000754000-memory.dmp

Filesize
16KB

Download