f23a5634117ef9692f0463fdc8e5b3304b44a5ab0d4790d71f90f4a4ad927e9e

Analysis

max time kernel
227s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe
Size

19KB
MD5

11cdc844d286157c33d3ac8d112920ab
SHA1

f45aa379a6862a5a6c8b66c2edd275e274a7d076
SHA256

f23a5634117ef9692f0463fdc8e5b3304b44a5ab0d4790d71f90f4a4ad927e9e
SHA512

e9afaa6061f3622e60e663ff3c67829962f2c982eea0a8683ad6b1f4fb70de2b41de6aba5a0496f535f5afd3e6fddf909d4313ce71450c707918e132cb778d2e
SSDEEP

384:reXmKzw1TybgIa3vATEXO5cbYND28IBlbhq2lj2tR:rR1W/a3WEen2hHMyjgR

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1260	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\ticisms = "C:\\Windows\\ticisms.exe"	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ticisms.dll	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ticisms.exe	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe
File opened for modification	C:\Windows\ticisms.exe	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1260	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe
1260	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1260	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1228	1260	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe	9
PID 1260 wrote to memory of 1228	1260	f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe	9

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228
- C:\Users\Admin\AppData\Local\Temp\f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe
  "C:\Users\Admin\AppData\Local\Temp\f45aa379a6862a5a6c8b66c2edd275e274a7d076.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ticisms.dll

Filesize
30KB

MD5
0882f5ea51fb3a216c0a07bdd0b4ac07

SHA1
c315acae23171ce80665f54bbfac7011ced1b99e

SHA256
9886d50b9def00254fc606c2a6fddba4691a5b3d4e039041b36ccd2fe8617b15

SHA512
3c667d5c73dbf409173bd54d29f6ca2f5d113e1531be9c98b3333d4d9cc9bc659ab5595b517301f28a41d2f0c84c31de0710cdb97067c2695f6b4b159d87a529

Download Submit
memory/1228-54-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/1228-55-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download