edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
Size

366KB
MD5

7ddc9d7e7d73ac709c5d549fda478360
SHA1

f786cc4bf8db1660331fbd85410fdb3d20e0939a
SHA256

edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622
SHA512

06475435f7744d047365312189c4957289d7559bac2dfe39c0489cfe19caf569bb10693c76bc363557068b3c69adebbc7793cea2327f88361a636f6c51b4828c
SSDEEP

6144:4f+zrJY+/vLTHu4GATr9eRjVla9qqz3xKrBcZmGizBJhtb1xbKIAQMkigXf:nmqOw9eNVw9qq3Si8GUTb5Mkiuf

Score

8^/10

persistence

Malware Config

Signatures

Uses Session Manager for persistence 2 TTPs 3 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2064	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2108	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	79
PID 3012 wrote to memory of 2108	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	79
PID 3012 wrote to memory of 2108	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	79
PID 3012 wrote to memory of 1696	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	80
PID 3012 wrote to memory of 1696	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	80
PID 3012 wrote to memory of 1696	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	80
PID 3012 wrote to memory of 4968	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	81
PID 3012 wrote to memory of 4968	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	81
PID 3012 wrote to memory of 4968	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	81
PID 3012 wrote to memory of 2064	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	85
PID 3012 wrote to memory of 2064	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	85
PID 3012 wrote to memory of 2064	3012	edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe	85

C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe
"C:\Users\Admin\AppData\Local\Temp\edacec5165574683223b96666a6ab206089fe2c60c45d4b010e899441b7ba622.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:2108
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:1696
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:4968
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM javasq2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-136-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-142-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3012-138-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-137-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-139-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-140-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-141-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-132-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3012-135-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-134-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-148-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-133-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/3012-147-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download