ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4

Analysis

max time kernel
126s
max time network
143s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe
Size

204KB
MD5

8b5f01620fd45c3eb2777ec6b05cf3e0
SHA1

9ef421abf04fdefa7b05cf4c4c1ad482861d5bc4
SHA256

ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4
SHA512

7aded2b2f5c6fdfb2d99f477931e257576bd9d63dc7710b651938bbcf3fd6b1f7feee8eb1a7d38356fb849dbc53e5595f9644687528742b33e37c294af835558
SSDEEP

3072:iKBQ3Vqm6tRjjUDJB/2P1g2sQIXbEZqB7KqNADMxoUXR0cAxUuUBoA5IeakDa/T2:ismQU4qJKkAD8oUXycAx+oA5Ik

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1458BE0A-932F-F1F6-B7C3-42879344A971}	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1458BE0A-932F-F1F6-B7C3-42879344A971}\stubpath = "%SystemRoot%\\system32\\V3Medic.exe"	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe

Deletes itself 1 IoCs

pid	Process
1060	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\V3Medic.exe	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe
File opened for modification	C:\Windows\SysWOW64\V3Medic.exe	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1356	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	28
PID 1224 wrote to memory of 1356	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	28
PID 1224 wrote to memory of 1356	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	28
PID 1224 wrote to memory of 1356	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	28
PID 1224 wrote to memory of 1060	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	32
PID 1224 wrote to memory of 1060	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	32
PID 1224 wrote to memory of 1060	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	32
PID 1224 wrote to memory of 1060	1224	ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe	32

C:\Users\Admin\AppData\Local\Temp\ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe
"C:\Users\Admin\AppData\Local\Temp\ae8a4e198ec116fc0cc01e46bb60092b28108eae318dc76768d729583f7fbef4.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{1458BE0A-932F-F1F6-B7C3-42879344A971}" /f
  2⤵
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\AE8A4E~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-55-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download