c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe
Size

44KB
MD5

08a32cfbec6df66d38b41c264d6a64be
SHA1

135954b3f5298e69fa26c3858ccaf19ff789d810
SHA256

c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864
SHA512

bd18aaa0c2f4895006552d9fd214420c847f2ff1e3be4a3d74101c5eabf5f917dd06cb71e91386d0745539c37a8bfb98b9f2e1bf55b5e5b8e5555f6130f159a9
SSDEEP

768:3mkrk4TaxKkXf6fsL8WlOwbsA349huw+Scc9NR57f99sVlXIJroYXfx3xXtGgGrE:PaDCa82DIkQgScERVnsVtIlPPtGu

Score

6^/10

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\CurrentVersion\Modules\Update\Settings	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1488 set thread context of 1076	1488	c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe	26

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1076	1488	c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe	26
PID 1488 wrote to memory of 1076	1488	c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe	26
PID 1488 wrote to memory of 1076	1488	c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe	26
PID 1488 wrote to memory of 1076	1488	c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe	26
PID 1488 wrote to memory of 1076	1488	c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe	26

C:\Users\Admin\AppData\Local\Temp\c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe
"C:\Users\Admin\AppData\Local\Temp\c5e78a54f9d697883ebf5be178f4d658ab63e1b3c0c0c871871e099cf552a864.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Checks for any installed AV software in registry
  PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Security Software Discovery

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-54-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1076-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1076-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download