ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963

Analysis

max time kernel
262s
max time network
336s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe
Size

28KB
MD5

b821c6df0e5b048af76851cf9d5f07b2
SHA1

65a236843218e66cfb2a06d6101ad6b1e48e4408
SHA256

ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963
SHA512

7fcfaa0a8c19af8fb0bcd2808069eeabd87434ae6b84b01c0f284b374af58026f52217ad9187bb2308f56bdf0759f1a1f44445ee306042e4930701c528208ac5
SSDEEP

384:CQkHzFODIerBZYPvIy7xcma7dgDss/An6:CQkH+3YL7xTuQZon6

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MyRAT = "C:\\WINDOWS\\systemA.exe"	ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\systemA.exe	ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe
File opened for modification	C:\WINDOWS\systemA.exe	ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe
File opened for modification	C:\WINDOWS\Prfass.dll	ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	62	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	78	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	81	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2024	ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe

C:\Users\Admin\AppData\Local\Temp\ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe
"C:\Users\Admin\AppData\Local\Temp\ca8a7998f424d78a5a21dee2f18ab2c2c997b9ad8acc3114739a55cd159c4963.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads