f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba

Analysis

max time kernel
327s
max time network
352s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
Size

852KB
MD5

aef5cf5d379fa5bc10d067ec809f706c
SHA1

307deb40ed93f3d72bdc0e49bf464780eb340522
SHA256

f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba
SHA512

cce8aae3d90649fd3a17e73fa545cfff01b0967b5bf2d52b5a2fa1f8ae7d4f873e2a9284b091f212d7c49ea06acd107922d61c1ce53cb4c141c6c1ac9b964644
SSDEEP

12288:8ECWV7qqVjZL1SDitwWBi8C+lPY2M2GAu1mt0LDwrepD:8eV7LXL1S+Syc+lPY2M84p

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
File created	C:\Program Files\7-Zip\7z.exe	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
File created	C:\Program Files\7-Zip\7zFM.exe	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2264	f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe

C:\Users\Admin\AppData\Local\Temp\f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe
"C:\Users\Admin\AppData\Local\Temp\f014ec0b0093bdf1f0efab61924a395f157439c4349baf3221e5669649921dba.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-134-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads