97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
Size

406KB
MD5

c08673f7e77cd6df0429280a371441d7
SHA1

0ca657c5ad3ba4f7d6f125cc3add7060c6347952
SHA256

97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0
SHA512

24919df9645962c0c6c58129b93ba20b37d39071176347837261616bd41337a2e1da0b3306af9f4a6bd3021be7002b3e40f9b7542941fb36ecbc762dbf7cd333
SSDEEP

3072:0wzE3HTgKEB/pMN1m1BxpbKdHFj9TiZHgCITUhoTRo7BZcOe4Sm3o+9Amwku5SUC:hE3zgJRpMutbqMHgCayne4SkQ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "àþ\x19"	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\Microsoft Update = "àþ\x19"	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "àþ\x19"	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\system.exe	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\# ::1 localhost	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe

C:\Users\Admin\AppData\Local\Temp\97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe
"C:\Users\Admin\AppData\Local\Temp\97401f630fb8ae36927519a7691a8e78662722e3dfc120bfc1fbcabcdba017f0.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-132-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1868-133-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download