4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f

General

Target

4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
Size

264KB
MD5

17b3383a638c8e71894afdab1a2a5663
SHA1

4c26ddeab4ae5bc78bfd9002e021311c80ea0396
SHA256

4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f
SHA512

265a8dd85bc1c3e456e38734818f08faf4c71451082dca9dd7182c348284158ff31771eb4d2ebf6ee157640ee91825c90e57a326d17af7d72efae030af23fb5c
SSDEEP

3072:8S8RUOa/qrXc/5YDuSrtJxQMOGcNZUKFLYhlBOGov1DsHMchNvHVial6Px7QeZkC:92A/UuSfxrZcrjLYvBBovi7JgP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1696	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	28
PID 1992 wrote to memory of 1696	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	28
PID 1992 wrote to memory of 1696	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	28
PID 1992 wrote to memory of 1696	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	28
PID 1992 wrote to memory of 1996	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	29
PID 1992 wrote to memory of 1996	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	29
PID 1992 wrote to memory of 1996	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	29
PID 1992 wrote to memory of 1996	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	29
PID 1992 wrote to memory of 1980	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	30
PID 1992 wrote to memory of 1980	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	30
PID 1992 wrote to memory of 1980	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	30
PID 1992 wrote to memory of 1980	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	30
PID 1992 wrote to memory of 548	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	31
PID 1992 wrote to memory of 548	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	31
PID 1992 wrote to memory of 548	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	31
PID 1992 wrote to memory of 548	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	31
PID 1992 wrote to memory of 1808	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	32
PID 1992 wrote to memory of 1808	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	32
PID 1992 wrote to memory of 1808	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	32
PID 1992 wrote to memory of 1808	1992	4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe	32

C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
"C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
  "C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe"
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
  "C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe"
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
  "C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe"
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
  "C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe"
  2⤵
  PID:548
- C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe
  "C:\Users\Admin\AppData\Local\Temp\4ac4190585ef636ef707459413641fcd87fc6e4f3b112b72b564554e16d9fa2f.exe"
  2⤵
  PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x00000000002D0000-0x000000000031A000-memory.dmp

Filesize
296KB

Download
memory/1992-55-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing