215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6 | Triage

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:14

Sharing

Report Analysis Logs

General

Target

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
Size

147KB
MD5

cb2d6ea208bbd1e42fb69ceb461d2f72
SHA1

a88ca24aeef56d692feff6fe0f0ac9df09a82796
SHA256

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6
SHA512

e8a5be38e7f06b751068b3d43e56fe8a82d73c796e8f8044498878e1bd8cc7b0d497e34f81b74c753235e7af4a6a196981c515a4778fc7cc8a62ca7505fa3301
SSDEEP

3072:FaJvDmCOU4piJA7vrOaUNC3Hjljb7K/w/qKewWZIiB64d5vPtjnXuG:FaJvqvU4lrOR83U/wCwWqild5vPl

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

4144 cmd.exe

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Desktop\\Install\\{bfcb9398-bfb2-ca3f-1731-e604ea3da242}\\❤≸⋙\\Ⱒ☠⍨\\\u202eﯹ๛\\{bfcb9398-bfb2-ca3f-1731-e604ea3da242}\\GoogleUpdate.exe\" >"	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

description	pid	process	target process
PID 3368 set thread context of 4144	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

pid	process
3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
3056
3056

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3056
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

pid process

3368 215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

description	pid	process
Token: SeRestorePrivilege	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
Token: SeDebugPrivilege	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
Token: SeDebugPrivilege	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
Token: SeDebugPrivilege	3056

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3056

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe

description	pid	process	target process
PID 3368 wrote to memory of 4144	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe	cmd.exe
PID 3368 wrote to memory of 4144	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe	cmd.exe
PID 3368 wrote to memory of 4144	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe	cmd.exe
PID 3368 wrote to memory of 4144	3368	215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe
"C:\Users\Admin\AppData\Local\Temp\215e37b2c56e74858f610aa6625c64f1b99f9e05f3261d2b4196b0246611a8c6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:4144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-137-0x0000000000970000-0x0000000000982000-memory.dmp

Filesize
72KB

Download
memory/3368-132-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3368-133-0x0000000000470000-0x000000000049D000-memory.dmp

Filesize
180KB

Download
memory/3368-135-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3368-136-0x0000000000470000-0x000000000049D000-memory.dmp

Filesize
180KB

Download
memory/4144-134-0x0000000000000000-mapping.dmp

Download