f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47

Analysis

max time kernel
152s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
Size

111KB
MD5

df14538976a8c14538f89b76b018b4e5
SHA1

f2d4ea8018c35cda8594518b7a1baae93376b0cc
SHA256

f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47
SHA512

6bd50e4430a03ccc2bf0479ea2f04bb679a440362b5a2760118dad6beea3d49fc9e5b73c0c74acef9dae68852062685ea0bd5cee3552b28f442e6dabdfaae54b
SSDEEP

3072:g/yBdjojs7p0N8K/DqjHCdbB1SP7N9LGXqSQXV3v8:2yB2w7pyLqj6BILfRv

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kaspersky Anti-Virus Protection = "DEF"	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Kaspersky Anti-Virus Protection = "DEF"	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kaspersky.exe	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1532	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
1532	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
1532	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
1532	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
1532	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe

C:\Users\Admin\AppData\Local\Temp\f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe
"C:\Users\Admin\AppData\Local\Temp\f39ea7a079e03b49680f50b8bca39490c4a9037dd923a557f3219a62bb8caf47.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1532-55-0x00000000005C0000-0x0000000000679000-memory.dmp

Filesize
740KB

Download
memory/1532-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1532-57-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download