20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964

Analysis

max time kernel
148s
max time network
172s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe
Size

17KB
MD5

f0d271a854dcb3c58be61e8ef5abd59d
SHA1

b5970e05ae11c3044e85a301aea80f043ebd9a7f
SHA256

20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964
SHA512

98662b28298e96c15bf17bf07d55b0ec1a8e28a132abe93d0b3f3a1e2e75f49a802e792012049318376c423ef39b3307669ab5f723fbf3be7f2ff94ca5ad4e79
SSDEEP

384:2RTJQLKfCDN/aGQrl/1ItHLYLs+Ir0X8wF+2o32BcF:alqZkG2ToHULs7rxT2C

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-6075760887587958658897\winmgr.exe = "C:\\Users\\Admin\\M-6075760887587958658897\\winmgr.exe:*:Enabled:Microsoft Windowz"	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe

Executes dropped EXE 1 IoCs

pid	Process
304	winmgr.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1500-55-0x0000000000010000-0x0000000000020000-memory.dmp	upx
behavioral1/files/0x000a0000000139f2-56.dat	upx
behavioral1/files/0x000a0000000139f2-58.dat	upx
behavioral1/memory/1500-59-0x0000000000010000-0x0000000000020000-memory.dmp	upx
behavioral1/memory/304-61-0x0000000000CC0000-0x0000000000CD0000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1500	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windowz = "C:\\Users\\Admin\\M-6075760887587958658897\\winmgr.exe"	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 304	1500	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe	27
PID 1500 wrote to memory of 304	1500	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe	27
PID 1500 wrote to memory of 304	1500	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe	27
PID 1500 wrote to memory of 304	1500	20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe	27

C:\Users\Admin\AppData\Local\Temp\20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe
"C:\Users\Admin\AppData\Local\Temp\20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964.exe"
1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\M-6075760887587958658897\winmgr.exe
  C:\Users\Admin\M-6075760887587958658897\winmgr.exe
  2⤵
  - Executes dropped EXE
  PID:304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\M-6075760887587958658897\winmgr.exe

Filesize
17KB

MD5
f0d271a854dcb3c58be61e8ef5abd59d

SHA1
b5970e05ae11c3044e85a301aea80f043ebd9a7f

SHA256
20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964

SHA512
98662b28298e96c15bf17bf07d55b0ec1a8e28a132abe93d0b3f3a1e2e75f49a802e792012049318376c423ef39b3307669ab5f723fbf3be7f2ff94ca5ad4e79

Download Submit
\Users\Admin\M-6075760887587958658897\winmgr.exe

Filesize
17KB

MD5
f0d271a854dcb3c58be61e8ef5abd59d

SHA1
b5970e05ae11c3044e85a301aea80f043ebd9a7f

SHA256
20d2acfbfdeb9c5c1bce814fec7838a4d8c779749415f74332011b8da2ee9964

SHA512
98662b28298e96c15bf17bf07d55b0ec1a8e28a132abe93d0b3f3a1e2e75f49a802e792012049318376c423ef39b3307669ab5f723fbf3be7f2ff94ca5ad4e79

Download Submit
memory/304-61-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

Filesize
64KB

Download
memory/1500-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1500-55-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/1500-59-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads