7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a

Analysis

max time kernel
124s
max time network
157s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a.exe
Size

32KB
MD5

670f9745418882978289166c26c291ed
SHA1

4a793a81fed3198c7d2abc92b26101e7fa63e9d3
SHA256

7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a
SHA512

506ccb1854ef55e6b3cd75199c728e1d0deac325f93312fe62637d07a1d6410cab62723be300122f3377b7f3595e9db0006f8a5348f133b636b856cddcb25df7
SSDEEP

384:xNbONPmamlQuFiiyyHRGbcwtZ1ccvXgICLQgsmaFfhe6B:TbjRyyqcwtzccvQ/QxFz

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1484	CScript.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	scrcons.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	scrcons.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecision = "0"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\a2-e9-a5-a8-90-df	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecisionTime = 503a049ba807d901	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\a2-e9-a5-a8-90-df	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecisionReason = "1"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecision = "0"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadDecision = "0"	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadNetworkName = "Network 2"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecisionReason = "1"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDetectedUrl	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDecisionTime = 503a049ba807d901	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\JITDebug = "0"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadDecisionReason = "1"	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	scrcons.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{423E2C3A-0A18-4186-8DC8-103F189F6C6E}\WpadDecisionTime = 503a049ba807d901	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df\WpadDetectedUrl	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	scrcons.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-e9-a5-a8-90-df	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	scrcons.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	scrcons.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	scrcons.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1484	1076	7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a.exe	28
PID 1076 wrote to memory of 1484	1076	7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a.exe	28
PID 1076 wrote to memory of 1484	1076	7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a.exe	28
PID 1076 wrote to memory of 1484	1076	7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a.exe	28

C:\Users\Admin\AppData\Local\Temp\7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a.exe
"C:\Users\Admin\AppData\Local\Temp\7758d8a31b784dce4529cbafa62069d83e814ead35b4895ff3b7ea3c7738a69a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\CScript.exe
  CScript /nologo C:\\Users\\Admin\\AppData\\Local\\Temp\\upcbras.js
  2⤵
  - Deletes itself
  PID:1484

C:\Windows\system32\wbem\scrcons.exe
C:\Windows\system32\wbem\scrcons.exe -Embedding
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1692

C:\Windows\system32\wbem\scrcons.exe
C:\Windows\system32\wbem\scrcons.exe -Embedding
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\upcbras.js

Filesize
411B

MD5
329a6a7d10e950f1197bdf4c88b29c2a

SHA1
36402cfd90eec1290a2f02efb4801e5cd4370668

SHA256
1db04649ca5cef334caf507614c88f13a52ea2eea5f77c52a5e3ee36419cfcf5

SHA512
db9179e55c3eb14030290e8dee2e49255f056ff822f7946260a7eff7bc182091dbf7d42bb099bdc7540d2621e1b23510e37f62be7776317ee28b826b6157c0d6

Download Submit
memory/1076-54-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1484-57-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads