a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8

Analysis

max time kernel
11s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
Size

372KB
MD5

e44059e1d6531084764190d950cddc5b
SHA1

234b647b094cc3156dfc29065d72b358c2dcb4e8
SHA256

a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8
SHA512

f622ad2c0ab5bb121e87c0b8282f8a6f8252ac781d087a45be752d78a5469c89d949a566114a6f284c164ff352ee487a87bce92948e1afaebfc00a66e39e6e0d
SSDEEP

6144:IiTti+B0bL7tLA5Vp34yYdj4G7v4G7AWFn4G7AWF/:nPB0bdLAVNJgJAOA6

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ball = "C:\\WINDOWS\\Ball.exe"	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\Ball.exe	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
File opened for modification	C:\WINDOWS\Ball.exe	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
876	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
876	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
876	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
876	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
876	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe

C:\Users\Admin\AppData\Local\Temp\a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe
"C:\Users\Admin\AppData\Local\Temp\a64cfdc0896af8b505a745b2d8a28bb19e832a09995411123cf2fc6841c77fb8.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download