360896b9cf3160c2299575891f559b6d3ce007d7fa442061d291dd65891f6bf9

Analysis

max time kernel
121s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2023, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

avicapn32.exe
Size

1.0MB
MD5

73d3db61836f4fd75aaa6a91c01ac591
SHA1

9fd779727cbaa038d690d133daf69ff2dbe6e609
SHA256

360896b9cf3160c2299575891f559b6d3ce007d7fa442061d291dd65891f6bf9
SHA512

af4b1ab31751aaba657b543dd0c5958b6c1663eb790bdf11ee6e258d1edda79750f6368e60dd46d943c8d0a1582102d2ee30857a259659290395d282077c5621
SSDEEP

24576:iadTl2nMSGmA0z9NXT9t0S1hRFK6kGJhrN6+d:iQl2K5ED9t0S3RY1GLrJ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	avicapn32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneLaunch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avicapn32.exe"	avicapn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	376	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\avicapn32.exe
"C:\Users\Admin\AppData\Local\Temp\avicapn32.exe"
1⤵
- Adds Run key to start application
PID:376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 324
  2⤵
  - Program crash
  PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 376 -ip 376
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-132-0x00000000006E0000-0x0000000000816000-memory.dmp

Filesize
1.2MB

Download
memory/376-133-0x0000000003210000-0x000000000339B000-memory.dmp

Filesize
1.5MB

Download
memory/376-134-0x0000000003140000-0x0000000003144000-memory.dmp

Filesize
16KB

Download
memory/376-135-0x00000000015C0000-0x00000000015C3000-memory.dmp

Filesize
12KB

Download
memory/376-136-0x0000000001780000-0x0000000001785000-memory.dmp

Filesize
20KB

Download
memory/376-137-0x00000000006E0000-0x0000000000816000-memory.dmp

Filesize
1.2MB

Download
memory/376-138-0x0000000003210000-0x000000000339B000-memory.dmp

Filesize
1.5MB

Download