9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5

Analysis

max time kernel
240s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
Size

80KB
MD5

c0026714eed50027fe46f751c8a10711
SHA1

471aaceec51d64baceebe48e64a9bc0d1bf58b8c
SHA256

9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5
SHA512

33ad93559401b07f10a9491628661272d259a74bbbf7d4b3d46683e4a58227979d87a01fd446a43d73bb9ac45216279f7ac7fffe9bd9e6fc0264f90792e6af07
SSDEEP

1536:FjL+WOsskr+2wMaK6RiAfLiYb6vTV/WWOOqeQmSY0Uy:FjlE2YfLiYuv1vOMgP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe:*:Enabled:Microsoft Windows Update Platform"	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\systme = "C:\\WINDOWS\\system32\\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe"	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 524 set thread context of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28
PID 524 wrote to memory of 1040	524	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	28

C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
"C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524
- C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
  2⤵
  - Modifies firewall policy service
  - Adds Run key to start application
  PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-56-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-57-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-59-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-60-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-63-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-65-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-62-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-61-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-66-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-67-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-68-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1040-69-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1040-70-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads