e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe
Size

12KB
MD5

b807da517a4d8a25a8efb970dda4824a
SHA1

a6377ead2f6426c7755cecf7c4d66dbda2f14284
SHA256

e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796
SHA512

9c3f0d63c568dba7ab1f15d255868ea9ff45efc45457ae69b3e5672ca58166f9ccc3d859ba0db5a0ca111363b2895c749459f4b41b3062694869dd90d45269c8
SSDEEP

192:+kMaRxe0LbICYnKUnavCg3lC6rcxuJAYTjaL6vzJQhbjpBS1mbDAVlDRMB:+kNHe0jfUnXg34uJDTjaLFBB

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RsTray = "C:\\Windows\\system32\\scvhost.exe"	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4212	5040	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe	79
PID 5040 wrote to memory of 4212	5040	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe	79
PID 5040 wrote to memory of 4212	5040	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe	79
PID 5040 wrote to memory of 4464	5040	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe	80
PID 5040 wrote to memory of 4464	5040	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe	80
PID 5040 wrote to memory of 4464	5040	e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe	80
PID 4464 wrote to memory of 1648	4464	cmd.exe	84
PID 4464 wrote to memory of 1648	4464	cmd.exe	84
PID 4464 wrote to memory of 1648	4464	cmd.exe	84
PID 4212 wrote to memory of 1328	4212	cmd.exe	83
PID 4212 wrote to memory of 1328	4212	cmd.exe	83
PID 4212 wrote to memory of 1328	4212	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe
"C:\Users\Admin\AppData\Local\Temp\e56aa66b8430d7dcf4931f866608d794f8ee1b6a4c3f329a3b59396cd163c796.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32 /e /p everyone:f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32 /e /p everyone:f
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f
    3⤵
    PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...