d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d

Analysis

max time kernel
191s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe
Size

859KB
MD5

8f681a78851890c61aef92afa2b5362f
SHA1

d739576fe715a87deef2fc62580f56b2ba095d71
SHA256

d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d
SHA512

e89f4ac767064012781bc6bd80f5d948b9535b8e8dfdb02ecf6c511b34141ce3e284fb4cc836185d433fe15d99fcc4e862c4936d318c801909e3603206568229
SSDEEP

12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaqTqlZqk6A:Itb20pkaCqT5TBWgNQ7a6qik6A

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\8011 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mspnnojf.scr"	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WerFault.exe	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3484 set thread context of 4564	3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe	82

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\mspnnojf.scr	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe
3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe
3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe
3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe
3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4564	3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe	82
PID 3484 wrote to memory of 4564	3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe	82
PID 3484 wrote to memory of 4564	3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe	82
PID 3484 wrote to memory of 4564	3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe	82
PID 3484 wrote to memory of 4564	3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe	82
PID 3484 wrote to memory of 4564	3484	d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe	82

C:\Users\Admin\AppData\Local\Temp\d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe
"C:\Users\Admin\AppData\Local\Temp\d472b0942ecd200d41093dde85e51d17d4f7adc01bba5972581ad5659251ca9d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\WerFault.exe
  "C:\Windows\SysWOW64\WerFault.exe"
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Adds policy Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4564-133-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4564-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4680-134-0x0000000000380000-0x0000000000385000-memory.dmp

Filesize
20KB

Download
memory/4680-136-0x0000000000380000-0x0000000000385000-memory.dmp

Filesize
20KB

Download