b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe
Size

80KB
MD5

647f4fa1dd79369052b83861b0125d7f
SHA1

acbf5aaa6184a3e13a56eee50605b99dc073fbe5
SHA256

b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866
SHA512

654e3e85f47a40465edf1030b7c0315a7395d581ab4031f907a2812e2c0f51074cfc63872d2223467ddbcdfa7b4868fe0b44ec142f83c611d4c92ff124ca46f2
SSDEEP

1536:/95S7dmlVz/P6N2tvrKebf5UzeVFYjCKyDn/IyHglOJJWSaVwzSiC2d:/LS7Qzam225UCVsCK27JJWSaViSib

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4252-136-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/4252-139-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inetserv = "C:\\Windows\\system32\\inetserv.exe"	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\inetserv.exe	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe
File created	C:\Windows\SysWOW64\inetserv.exe	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4252 set thread context of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82
PID 4252 wrote to memory of 3120	4252	b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe	82

C:\Users\Admin\AppData\Local\Temp\b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe
"C:\Users\Admin\AppData\Local\Temp\b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe
  C:\Users\Admin\AppData\Local\Temp\b37747c43979de2da7bc6e87031757b61c240de6bbd66ff036793ca5b565a866.exe
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  PID:3120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3120-135-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3120-138-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3120-140-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3120-141-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4252-136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4252-139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download