9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5

Analysis

max time kernel
112s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
Size

80KB
MD5

c0026714eed50027fe46f751c8a10711
SHA1

471aaceec51d64baceebe48e64a9bc0d1bf58b8c
SHA256

9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5
SHA512

33ad93559401b07f10a9491628661272d259a74bbbf7d4b3d46683e4a58227979d87a01fd446a43d73bb9ac45216279f7ac7fffe9bd9e6fc0264f90792e6af07
SSDEEP

1536:FjL+WOsskr+2wMaK6RiAfLiYb6vTV/WWOOqeQmSY0Uy:FjlE2YfLiYuv1vOMgP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe:*:Enabled:Microsoft Windows Update Platform"	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\systme = "C:\\WINDOWS\\system32\\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe"	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81
PID 1336 wrote to memory of 4648	1336	9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe	81

C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
"C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\9724fd8e1b02c0c327ff054258ace4047a8b8dda46aebb0e1d4a4f7bd541b1c5.exe
  2⤵
  - Modifies firewall policy service
  - Adds Run key to start application
  PID:4648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4648-138-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4648-139-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4648-140-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4648-141-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4648-142-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads