77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918

Analysis

max time kernel
162s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe
Size

152KB
MD5

5b8655367d750964e1c25db99609d1cc
SHA1

39891628760cb782758b9ded2871780c2921826f
SHA256

77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918
SHA512

52922807ac78082af8973ecc83d12eef2c65b60726ccccef46b07e05e81f84d933a7a3a0f332f42c2ca4ce2d9b1fcc812f46fe97bda788f41fb0aa3b84ceb38f
SSDEEP

1536:lajwWzwgVwPLoJ8VQP0XyXnIcWWXaUZYynkhLtvtHciUcjD/NJ2v6yVpXA:lajwWcfa8a+yXn9RXaUZA30+7C6yV

Score

8^/10

persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RegisteredApplications = "C:\\Users\\Admin\\AppData\\Roaming\\63283F.exe"	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1180-132-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/1180-133-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 968	1180	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	84

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
968	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe
968	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 968	1180	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	84
PID 1180 wrote to memory of 968	1180	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	84
PID 1180 wrote to memory of 968	1180	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	84
PID 1180 wrote to memory of 968	1180	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	84
PID 1180 wrote to memory of 968	1180	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	84
PID 1180 wrote to memory of 968	1180	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	84
PID 968 wrote to memory of 3480	968	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	86
PID 968 wrote to memory of 3480	968	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	86
PID 968 wrote to memory of 3480	968	77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe	86

C:\Users\Admin\AppData\Local\Temp\77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe
"C:\Users\Admin\AppData\Local\Temp\77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe
  C:\Users\Admin\AppData\Local\Temp\77e8d267d29e841bc5ccfbcb2b4e413440f7c29b6fec52c53d3caf6448990918.exe
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Adds policy Run key to start application
    PID:3480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-135-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/968-136-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/968-138-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1180-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1180-133-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3480-140-0x0000000000720000-0x0000000000724000-memory.dmp

Filesize
16KB

Download
memory/3480-139-0x0000000000EA0000-0x0000000000EAE000-memory.dmp

Filesize
56KB

Download
memory/3480-141-0x0000000000E40000-0x0000000000E4F000-memory.dmp

Filesize
60KB

Download