5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146 | Triage

Analysis

max time kernel
157s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 12:34

Sharing

Report Analysis Logs

General

Target

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
Size

260KB
MD5

62429d650d4228fcced6b458eb63e91a
SHA1

e844029fc1d45047c75dafd5d3b93ec86b431a0d
SHA256

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146
SHA512

2dfe745b97cc746dda87d20073ecaf8818d145444dd5acdf12c386fe5bf3861754cc30c9d8da0852948fae8078335aeaf354c11f1a22e49eed2bf8ca43f01fd8
SSDEEP

6144:HVyRQUrDVjUi3ZAmT2lq70xVP1YTCBlmsFvXXMI:HVy6Ur5VJ70/dME5XXB

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

4868 cmd.exe

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Desktop\\Install\\{e0613d90-9b67-ae60-58f9-584af5f18b89}\\❤≸⋙\\Ⱒ☠⍨\\\u202eﯹ๛\\{e0613d90-9b67-ae60-58f9-584af5f18b89}\\GoogleUpdate.exe\" >"	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

description	pid	process	target process
PID 4512 set thread context of 4868	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

pid	process
4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
1272
1272

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1272
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

pid process

4512 5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

description	pid	process
Token: SeRestorePrivilege	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
Token: SeDebugPrivilege	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
Token: SeDebugPrivilege	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
Token: SeDebugPrivilege	1272

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

1272

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe

description	pid	process	target process
PID 4512 wrote to memory of 4868	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe	cmd.exe
PID 4512 wrote to memory of 4868	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe	cmd.exe
PID 4512 wrote to memory of 4868	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe	cmd.exe
PID 4512 wrote to memory of 4868	4512	5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe
"C:\Users\Admin\AppData\Local\Temp\5fedbc3b71195496fc6aebff9d06997c0540ee7a6a8570c86ead9551fddaf146.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Deletes itself
PID:4868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-135-0x00000000012D0000-0x00000000012E2000-memory.dmp

Filesize
72KB

Download
memory/4512-133-0x00000000001C0000-0x0000000000206000-memory.dmp

Filesize
280KB

Download
memory/4512-134-0x0000000000210000-0x0000000000231000-memory.dmp

Filesize
132KB

Download
memory/4868-132-0x0000000000000000-mapping.dmp

Download