ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3

Analysis

max time kernel
134s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe
Size

76KB
MD5

25fe35eab2bda27cb13dcdc3c604f17f
SHA1

be36aa7f1febbde1455fc655e115d4741704f5ff
SHA256

ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3
SHA512

a3436aea88e2115c8efe5f5f996302175155d0c74f8c4b3089e64994c36548aa7d9b154a001493a37f6ab2c57efd711899527be1faab22abf6431c329bdabb62
SSDEEP

768:2u17djCLTWQ+LMmdjjQ4hKMg8jfVjIbdu+KdoJzc5XvHFcoIPwHCO1XSBcb9KEsh:2uzCveYzsfZmboCq5ahO+c5KEsh

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1784	svchost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\x86kernel2 = "c:\\users\\admin\\appdata\\roaming\\12720314\\svchost.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regini.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	regini.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\x86kernel2 = "c:\\users\\admin\\appdata\\roaming\\12720314\\svchost.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	regini.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regini.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2244	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	81
PID 1536 wrote to memory of 2244	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	81
PID 1536 wrote to memory of 2244	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	81
PID 2244 wrote to memory of 4996	2244	cmd.exe	83
PID 2244 wrote to memory of 4996	2244	cmd.exe	83
PID 2244 wrote to memory of 4996	2244	cmd.exe	83
PID 2244 wrote to memory of 612	2244	cmd.exe	84
PID 2244 wrote to memory of 612	2244	cmd.exe	84
PID 2244 wrote to memory of 612	2244	cmd.exe	84
PID 1536 wrote to memory of 4932	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	85
PID 1536 wrote to memory of 4932	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	85
PID 1536 wrote to memory of 4932	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	85
PID 4932 wrote to memory of 2252	4932	cmd.exe	87
PID 4932 wrote to memory of 2252	4932	cmd.exe	87
PID 4932 wrote to memory of 2252	4932	cmd.exe	87
PID 4932 wrote to memory of 2592	4932	cmd.exe	88
PID 4932 wrote to memory of 2592	4932	cmd.exe	88
PID 4932 wrote to memory of 2592	4932	cmd.exe	88
PID 1536 wrote to memory of 2164	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	89
PID 1536 wrote to memory of 2164	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	89
PID 1536 wrote to memory of 2164	1536	ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe	89
PID 2164 wrote to memory of 1784	2164	cmd.exe	91
PID 2164 wrote to memory of 1784	2164	cmd.exe	91
PID 2164 wrote to memory of 1784	2164	cmd.exe	91
PID 1784 wrote to memory of 2636	1784	svchost.exe	92
PID 1784 wrote to memory of 2636	1784	svchost.exe	92
PID 1784 wrote to memory of 2636	1784	svchost.exe	92
PID 1784 wrote to memory of 1740	1784	svchost.exe	94
PID 1784 wrote to memory of 1740	1784	svchost.exe	94
PID 1784 wrote to memory of 1740	1784	svchost.exe	94
PID 1784 wrote to memory of 3680	1784	svchost.exe	96
PID 1784 wrote to memory of 3680	1784	svchost.exe	96
PID 1784 wrote to memory of 3680	1784	svchost.exe	96
PID 1784 wrote to memory of 3092	1784	svchost.exe	98
PID 1784 wrote to memory of 3092	1784	svchost.exe	98
PID 1784 wrote to memory of 3092	1784	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe
"C:\Users\Admin\AppData\Local\Temp\ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|CACLS "c:\users\admin\appdata\roaming\12720314\svchost.exe" /P "Admin:R"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "c:\users\admin\appdata\roaming\12720314\svchost.exe" /P "Admin:R"
    3⤵
    PID:612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|CACLS "c:\users\admin\appdata\roaming\12720314" /P "Admin:R"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "c:\users\admin\appdata\roaming\12720314" /P "Admin:R"
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Roaming\12720314\svchost.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Roaming\12720314\svchost.exe
    C:\Users\Admin\AppData\Roaming\12720314\svchost.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\regini.exe
      regini per
      4⤵
      Adds Run key to start application
      PID:2636
  - - C:\Windows\SysWOW64\regini.exe
      regini perper
      4⤵
      Adds Run key to start application
      PID:1740
  - - C:\Windows\SysWOW64\regini.exe
      regini perperper
      4⤵
      Adds Run key to start application
      PID:3680
  - - C:\Windows\SysWOW64\regini.exe
      regini perperperper
      4⤵
      Adds Run key to start application
      PID:3092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\per

Filesize
68B

MD5
77612e763aacc6671e0c81713b419a41

SHA1
99c986a0e3bc15532bbca5a18ff90de93fefe7fc

SHA256
08f53032b63ada0a816ab77088624bef24a5451b7c7e0de05f958e5bd4e6977b

SHA512
99f94d1016eb7bff8deed9eb68c6d26756b2b02a30c4aa5dcc111429e0117acfbc15d7f4119fe06abead5039ee241afc1e6756d2e2250a08fcc818a50598b6cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\perper

Filesize
68B

MD5
a6585d9cf9d692905da3ed6c1b9dd4c1

SHA1
166b3aece6d5a7d172acd0a1327af9265a5bf5d4

SHA256
50a38aee5de374bab740c163c3debc500041a2ee3aad01d466347eecf2540015

SHA512
a402fcebe80023edc9322adeecc89b8df845a80061008c26b890e33636869817460b57a326ee65dcd2bd7275933f9407be96aba7bfeae17530b55985ad00c65c

Download Submit
C:\Users\Admin\AppData\Local\Temp\perperper

Filesize
67B

MD5
e4bcd320585af9f77671cc6e91fe9de6

SHA1
15f12439eb3e133affb37b29e41e57d89fc90e06

SHA256
a1e0f5a9cfc9615222f04e65455c7c4c1ba86710275afffd472428a293c31ec8

SHA512
00497885531c0b84fe869828e5f2c0631f2f175f961c62175736487ae703252ba7393f882ffe99d8c4bcdb951172e35daa9ca41f45e64ce97fbae7721b25c112

Download Submit
C:\Users\Admin\AppData\Local\Temp\perperperper

Filesize
67B

MD5
58b2f90cc0182925ae0bab51700b14ab

SHA1
d2975adeb8dc68f2f5e10edee524de78e79828db

SHA256
8114822fe9a58e5ba08abb480dd595109c66a49d9afc404f85843915694c2964

SHA512
de6154d3d44c7e332f5cf1f3b1e4f20612ecd37f08fa60382ecc5008af2d9a55216357d6927e706fd2ef60b772e7941631fdfe9b1d615e5264e99cffe59ad782

Download Submit
C:\Users\Admin\AppData\Roaming\12720314\svchost.exe

Filesize
76KB

MD5
25fe35eab2bda27cb13dcdc3c604f17f

SHA1
be36aa7f1febbde1455fc655e115d4741704f5ff

SHA256
ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3

SHA512
a3436aea88e2115c8efe5f5f996302175155d0c74f8c4b3089e64994c36548aa7d9b154a001493a37f6ab2c57efd711899527be1faab22abf6431c329bdabb62

Download Submit
\??\c:\users\admin\appdata\roaming\12720314\svchost.exe

Filesize
76KB

MD5
25fe35eab2bda27cb13dcdc3c604f17f

SHA1
be36aa7f1febbde1455fc655e115d4741704f5ff

SHA256
ad5d0cc3dfd89127eb92aaa50d14cf48759a60b56019120de68fe42a655fdbc3

SHA512
a3436aea88e2115c8efe5f5f996302175155d0c74f8c4b3089e64994c36548aa7d9b154a001493a37f6ab2c57efd711899527be1faab22abf6431c329bdabb62

Download Submit