426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f

Analysis

max time kernel
140s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe
Size

63KB
MD5

a6b0762edfaeb0d8c9a249718cd6e697
SHA1

79451b966ef958f2a84f786b85d61601651cde19
SHA256

426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f
SHA512

65f30bfcbafe74a59a9db624880f280449b161d55b55e1b70d65ccae0b330cd4c191a3d00fd5f363e7d2b4652a7c6c0edb92d516b56a9871c6d895b4dedca197
SSDEEP

768:xJZ2XfTjdd3nldyAyMFuy1NHdEr4VdtQnt2kJFyb5H2+lxBTuuF92eCLJrFEfe:xJGjdJnlBFF1NH2r4VdWbJ49Hf31ubL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\flash = "C:\\Users\\Admin\\AppData\\Roaming\\EFhwKEj3vpuEhMd5Uc0NkLUbAQwr.exe"	426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

description	pid	process	target process
PID 4904 set thread context of 2512	4904	426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

explorer.exe

pid process

2512 explorer.exe
2512 explorer.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

pid process

4904 426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

pid process

4904 426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

explorer.exe

description pid process

Token: SeDebugPrivilege 2512 explorer.exe

pid	process
2512	explorer.exe
2512	explorer.exe

pid	process
4904	426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

pid	process
4904	426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

description	pid	process
Token: SeDebugPrivilege	2512	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe

description	pid	process	target process
PID 4904 wrote to memory of 2512	4904	426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe	explorer.exe
PID 4904 wrote to memory of 2512	4904	426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe	explorer.exe
PID 4904 wrote to memory of 2512	4904	426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe
"C:\Users\Admin\AppData\Local\Temp\426fabfff6fa90cf2a2df3eb2da2f699c27995e3871c132d941b0cb0b583c32f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4904

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-132-0x0000000000000000-mapping.dmp

Download
memory/2512-133-0x00000000009B0000-0x00000000009C3000-memory.dmp

Filesize
76KB

Download
memory/2512-134-0x00000000009B0000-0x00000000009C3000-memory.dmp

Filesize
76KB

Download