d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086

Analysis

max time kernel
157s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe
Size

37KB
MD5

463b3177af2dcc317ba1611b7c8ab48d
SHA1

44bcdb401506831a1e3da2b4d4a553a53e73d1a1
SHA256

d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086
SHA512

6870893bb98a7e327b367e7fef86c69674f171b3ccd8bd51dbda79740f7585aa202e33a72d1770f3a25fcae23cb43c6a3e25a7c18b96aa1251c584801978a0f7
SSDEEP

768:1YFD8Bd8yLspnm2NeJBIcRnL5ZJ3lJ1snqnRz7QLo/5:1YFgnItbNe3IgjjjsqR/b5

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12CFG515-K641-55SF-N66P = "C:\\RECYCLER\\S-1-5-21-0243636035-3055115376-381863306-1556\\pqlmq.exe"	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\RECYCLER\S-1-5-21-0243636035-3055115376-381863306-1556\Desktop.ini	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2192	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe
2192	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1108	2192	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe	46
PID 2192 wrote to memory of 1108	2192	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe	46
PID 2192 wrote to memory of 1108	2192	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe	46

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1108
- C:\Users\Admin\AppData\Local\Temp\d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe
  "C:\Users\Admin\AppData\Local\Temp\d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-132-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2192-133-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download