f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756

Analysis

max time kernel
175s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
Size

32KB
MD5

89732db5fc7fe411b13ab2d09a6d0e12
SHA1

d5be6ae9f27a8cf6eaec484c7eaec0d1e762daf1
SHA256

f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756
SHA512

3e61224fbe3de8a095b26fdf9cc905e58ea0c95649dc3c67188c3441c5e8bc06eca502125e20d15cac2cd9b06be49f6b349c88b8417441c8ce3db1bf49448f7e
SSDEEP

384:3IG+7Xu4bBDYTsOPg4uu1p5hKDqfflg9iacqXUMCADr4uOS:3IbCmBgsOXr1p5hKDqffl7eXLsz

Score

8^/10

evasion

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	REG.exe

Disables Task Manager via registry modification
evasion

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4264	REG.exe
4332	REG.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4264	4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe	79
PID 4320 wrote to memory of 4264	4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe	79
PID 4320 wrote to memory of 4264	4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe	79
PID 4320 wrote to memory of 4332	4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe	80
PID 4320 wrote to memory of 4332	4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe	80
PID 4320 wrote to memory of 4332	4320	f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe	80

C:\Users\Admin\AppData\Local\Temp\f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe
"C:\Users\Admin\AppData\Local\Temp\f269908ef50b85357f91ad0716ea3dc3633bd667ca3636f7e8a88b569ca8a756.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\REG.exe
  REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  - Modifies registry key
  PID:4264
- C:\Windows\SysWOW64\REG.exe
  REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...