b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe
Size

59KB
MD5

2c06d52f9352752e3086d8266e5c58d4
SHA1

e7f3ea5dc2cd7da75f93716e8278b9ec99abe539
SHA256

b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8
SHA512

6d2143f2f7001184e6955c27bef58cae85741adfc194ec0ba28dce25bf2560160985a881209fb41eb16839f563268ca664dbe11bd75adf72093e39a55a7576b5
SSDEEP

768:VQgS+b3qXaAC1L1KlWrpn5NyUQJrs+9EuBbtmBnn/LcisKl4qR:bbaKACfKupn5NnQ7zlt8nn/YisKldR

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1372	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	28
PID 864 wrote to memory of 1372	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	28
PID 864 wrote to memory of 1372	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	28
PID 864 wrote to memory of 1372	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	28
PID 864 wrote to memory of 1372	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	28
PID 864 wrote to memory of 1372	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	28
PID 864 wrote to memory of 1372	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	28
PID 864 wrote to memory of 1212	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	17
PID 864 wrote to memory of 1212	864	b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe	17

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe
  "C:\Users\Admin\AppData\Local\Temp\b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Users\Admin\AppData\Local\Temp\b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe
    "C:\Users\Admin\AppData\Local\Temp\b6c9502bd7aaf0277098a8796ad53a055a633961eb775ced1e21401f444688a8.exe"
    3⤵
    PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/864-59-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/1212-56-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1372-55-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download