c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe
Size

54KB
MD5

6de880a13169c841dcf4107279e8645b
SHA1

5699c5ab8476156034c1d4d093cd4f00859451e4
SHA256

c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726
SHA512

9175aa900a6e1400e99b03ff24ca22504b48eb0c16347fc6b8177e64207db06c2a53e863eb000997563e2ea91d09936b1cca3f202dfdfe046836f32627f7de78
SSDEEP

1536:3nLvs+iVqGJi+X9cgydqfTP7q0qPYNIFJyZ:3DmsAi+X9byrpV3yZ

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0C172D98-B610-DFAF-A00A-BABB5A0AC721}	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0C172D98-B610-DFAF-A00A-BABB5A0AC721}\stubpath = "%SystemRoot%\\system32\\GoogleUpdate.exe"	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe

Deletes itself 1 IoCs

pid	Process
700	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GoogleUpdate.exe	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe
File opened for modification	C:\Windows\SysWOW64\GoogleUpdate.exe	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2032	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	28
PID 1948 wrote to memory of 2032	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	28
PID 1948 wrote to memory of 2032	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	28
PID 1948 wrote to memory of 2032	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	28
PID 1948 wrote to memory of 700	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	32
PID 1948 wrote to memory of 700	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	32
PID 1948 wrote to memory of 700	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	32
PID 1948 wrote to memory of 700	1948	c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe	32

C:\Users\Admin\AppData\Local\Temp\c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe
"C:\Users\Admin\AppData\Local\Temp\c24102ed00ac40cb09e7b7a2152d93761ca30d12a3f7b113e16637ec6c851726.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{0C172D98-B610-DFAF-A00A-BABB5A0AC721}" /f
  2⤵
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C24102~1.EXE > nul
  2⤵
  - Deletes itself
  PID:700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-54-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1948-56-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1948-58-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download