aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f

Analysis

max time kernel
134s
max time network
223s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe
Size

44KB
MD5

2683f3600c5560e38df47f78572920a0
SHA1

8b484d9fe070c0dec4fabb0ea9d2990f045b9073
SHA256

aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f
SHA512

2f6313f0142ce665cde962d5470f24ca01e9c3b970a3c642b5b0a826b80925f32e76eacbed5a6adba1feba7cc38ee5245d1a2d3ef6603cc596c976c637c97c49
SSDEEP

768:S/GD6LSUM4EwJICDPceVa08eovmez4HzgAJoHsLKncD11Qdr4JF0KCyKOfh7:S/b93k0Ro0zziHsykk4+yKOl

Score

8^/10

persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Google = "C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe"	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1872-54-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1384	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1872	aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe
1872	aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1384	1872	aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe	28
PID 1872 wrote to memory of 1384	1872	aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe	28
PID 1872 wrote to memory of 1384	1872	aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe	28
PID 1872 wrote to memory of 1384	1872	aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe	28

C:\Users\Admin\AppData\Local\Temp\aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe
"C:\Users\Admin\AppData\Local\Temp\aa0c8fc7cf2733fbb8a1f8de0702dc0f2cb853ba55ea330e10e1775c9ae3ec4f.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Adds policy Run key to start application
  - Deletes itself
  PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-60-0x00000000008D0000-0x00000000008D8000-memory.dmp

Filesize
32KB

Download
memory/1384-61-0x0000000000080000-0x0000000000084000-memory.dmp

Filesize
16KB

Download
memory/1384-62-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/1384-63-0x0000000000090000-0x0000000000099000-memory.dmp

Filesize
36KB

Download
memory/1872-54-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1872-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1872-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1872-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download