822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Size

188KB
MD5

396d5216a867ebe67ca8db94ccd91a55
SHA1

31878f45ef6d1e72a0bb9cf6525ec8edaf06473f
SHA256

822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9
SHA512

6a803c0cbc0303b5456073fa8827520994f5250a286adff3ea735f62398589ee5a818ca6b57666681fd6285dd7b64c48e973ab0843b6620130c07c366b3ba187
SSDEEP

3072:p+ip66I8Xt3+dQc6hND8aJRWrmtVYkvqJerZam5/VdXhUOQF5/SnB9EF:lLI89aIwaJcmtxOKZayC7/qB9

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{bfcb9398-bfb2-ca3f-1731-e604ea3da242}\\n."	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{bfcb9398-bfb2-ca3f-1731-e604ea3da242}\\n."	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\clsid	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Token: SeDebugPrivilege	1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Token: SeDebugPrivilege	1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE
Token: SeShutdownPrivilege	2756	Explorer.EXE
Token: SeCreatePagefilePrivilege	2756	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2756	1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe	69
PID 1952 wrote to memory of 2756	1952	822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe	69

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2756
- C:\Users\Admin\AppData\Local\Temp\822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe
  "C:\Users\Admin\AppData\Local\Temp\822852617fc3e5649de0647969a8d9aaed12a52af2db3bb72d310a8466abf6c9.exe"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1952-133-0x00000000006A0000-0x00000000006D2000-memory.dmp

Filesize
200KB

Download
memory/1952-134-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1952-136-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2756-135-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/2756-137-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-138-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-141-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-142-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-140-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-139-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-143-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-144-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-145-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2756-147-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-146-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-149-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-153-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-151-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2756-150-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-148-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-154-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-155-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2756-156-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-157-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-158-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-159-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-160-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-161-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-162-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2756-163-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2756-164-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2756-165-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-166-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-167-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-168-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-169-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-170-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-171-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-172-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/2756-173-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download
memory/2756-174-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-175-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-176-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-177-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-178-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-179-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-180-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-181-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-182-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-183-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-184-0x00000000011B0000-0x00000000011C0000-memory.dmp

Filesize
64KB

Download
memory/2756-185-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download
memory/2756-186-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download
memory/2756-187-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/2756-188-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download
memory/2756-189-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download
memory/2756-190-0x00000000010C0000-0x00000000010D0000-memory.dmp

Filesize
64KB

Download