a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0

Analysis

max time kernel
146s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe
Size

84KB
MD5

cc0dbcc4f22d7b07cc3225c140406854
SHA1

894348680a4ec70ff94d049b6289f25d61c3b091
SHA256

a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0
SHA512

8bdd248434e57cb3bc5570f0be327805399b64415436468fc8d004213c03133bde097b2a728188c0ed07ffebd2431979a43e92b1caa870ac442a21bfc69640f6
SSDEEP

1536:0+fbr3Sxsx87WuA1f+/To0XwP6TRjiQ3PTxv6Ld+xWuzxgzG:0+fbr3SxsduKchN3Poa3D

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\administration = "C:\\Users\\Admin\\AppData\\Roaming\\whitepixel\\administration.exe"	a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\whitepixel\administration.exe\:Zone.Identifier:$DATA	a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2028	1416	a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe	27
PID 1416 wrote to memory of 2028	1416	a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe	27
PID 1416 wrote to memory of 2028	1416	a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe	27
PID 1416 wrote to memory of 2028	1416	a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe	27

C:\Users\Admin\AppData\Local\Temp\a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe
"C:\Users\Admin\AppData\Local\Temp\a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe"
1⤵
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - NTFS ADS
  PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0.exe

Filesize
84KB

MD5
cc0dbcc4f22d7b07cc3225c140406854

SHA1
894348680a4ec70ff94d049b6289f25d61c3b091

SHA256
a0601419d8ab68645c91cd04384e8d6395df3e4c3b482138c5653ed36fda02d0

SHA512
8bdd248434e57cb3bc5570f0be327805399b64415436468fc8d004213c03133bde097b2a728188c0ed07ffebd2431979a43e92b1caa870ac442a21bfc69640f6

Download Submit
memory/1416-55-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1416-57-0x0000000000956000-0x0000000000967000-memory.dmp

Filesize
68KB

Download
memory/1416-60-0x00000000742C0000-0x000000007486B000-memory.dmp

Filesize
5.7MB

Download
memory/1416-61-0x0000000000956000-0x0000000000967000-memory.dmp

Filesize
68KB

Download
memory/2028-58-0x0000000000000000-mapping.dmp

Download