779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf

Analysis

max time kernel
56s
max time network
98s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe
Size

33KB
MD5

6dbfbb317e593d1875858fcc8a9f58aa
SHA1

cdb2deb2ed26b5b8d453cb77ec42a40263caa38d
SHA256

779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf
SHA512

68cccf0ed51c20df676744c4866f82a0762603942ee6a9d74954b0dc1bcbe9c27f342953021da33d330aa7f8612bd2acf58484822ae7d8181f0750dcaf115d31
SSDEEP

384:51AF6ahsp3fJKEa2/EIa0CPfi/cMuBhm8Aom1l9CQAL:5g5ip3fgEJYPfiEMGM8AnrPAL

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Classes = "C:\\Users\\Admin\\AppData\\Roaming\\31C804.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
928	svchost.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1748	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe
1748	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 928	1748	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe	28
PID 1748 wrote to memory of 928	1748	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe	28
PID 1748 wrote to memory of 928	1748	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe	28
PID 1748 wrote to memory of 928	1748	779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe	28

C:\Users\Admin\AppData\Local\Temp\779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe
"C:\Users\Admin\AppData\Local\Temp\779711b6be304ce41f096d771cc4b93bf368eed8bcd7d1b84a4ca188a610bbbf.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Adds policy Run key to start application
  - Deletes itself
  PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-59-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/928-60-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/928-61-0x0000000000080000-0x0000000000084000-memory.dmp

Filesize
16KB

Download
memory/928-62-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/928-63-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/1748-54-0x0000000000401000-0x0000000000405000-memory.dmp

Filesize
16KB

Download
memory/1748-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1748-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1748-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download