189324e467efc3aa877a7f8a825aadc7ea5f1698abbe3e15eb686e5d8e2dff49

Analysis

max time kernel
39s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/03/2023, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e74d706b67705285a54359b008364d8c.exe
Size 4.5MB
Sample230310-pkgvfade94
SHA256 189324e467efc3aa877a7f8a825aadc7ea5f1698abbe3e15eb686e5d8e2dff49
MD5 e74d706b67705285a54359b008364d8c
SHA1 99712a5d96e54f456bafd6f3be13cd04719755c6
SHA512 69169c06dca49a5047d3bd966b5e2c9ef4a03ed621e6dcb110664e3b5b9c99053fe44b2bbbb3fb5e7af5f22aa05787f0b06935d0cfa0165be04eeef164c7368d
SSDEEP 98304:nvaEF0/xsHZ6Su6sGvh/EXUjeElp9PvnKJym:v8sHZ+sEXUiE/IJym
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1056	TemplatesAdobe-Type2.3.9.6.exe

Loads dropped DLL 2 IoCs

pid	Process
1184	AppLaunch.exe
1184	AppLaunch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\TemplatesAdobe-Type2.3.9.6 = "C:\\ProgramData\\TemplatesAdobe-Type2.3.9.6\\TemplatesAdobe-Type2.3.9.6.exe"	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1240 wrote to memory of 1184	1240	e74d706b67705285a54359b008364d8c.exe	28
PID 1184 wrote to memory of 1056	1184	AppLaunch.exe	29
PID 1184 wrote to memory of 1056	1184	AppLaunch.exe	29
PID 1184 wrote to memory of 1056	1184	AppLaunch.exe	29
PID 1184 wrote to memory of 1056	1184	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\e74d706b67705285a54359b008364d8c.exe
"C:\Users\Admin\AppData\Local\Temp\e74d706b67705285a54359b008364d8c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\ProgramData\TemplatesAdobe-Type2.3.9.6\TemplatesAdobe-Type2.3.9.6.exe
    "C:\ProgramData\TemplatesAdobe-Type2.3.9.6\TemplatesAdobe-Type2.3.9.6.exe"
    3⤵
    - Executes dropped EXE
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TemplatesAdobe-Type2.3.9.6.exe

Path C:\ProgramData\TemplatesAdobe-Type2.3.9.6\TemplatesAdobe-Type2.3.9.6.exe
Size 264.8MB
SHA256 759aeecbafb04e13607e37a9cb8c89b9b34a5f4014fc1ecd0efbaf4787d7bb69
MD5 c4bf73826557a2989dac3efffb65ae61
SHA1 9e57ad3ce8eae55c0732d7f2deabe42745e90ea5
SHA512 2c938168485c14aa5a1b2d090c51e3cbdce31aa9cb4b5b7bff6bac1c74d1671644c4395e7dce5e08008503a5f7b73da8b3cf4f103bbadd86847ce75dbe8ed4ba
SSDEEP 6291456:dzWDxHNUbxHOBEZRRbk6uJJ+nljgbAhEv8HCvfAvXa:VWDxQIl6uJMUbPv8UfAvXa
MD5 SHA1 SHA512 SSDEEP

Submit Download

TemplatesAdobe-Type2.3.9.6.exe

Path C:\ProgramData\TemplatesAdobe-Type2.3.9.6\TemplatesAdobe-Type2.3.9.6.exe
Size 265.7MB
SHA256 f2a962362b90d866a6f477a8f36d82205d09a5b2a7d4d8c876caca52b7cd6df8
MD5 d656f0cf01de907dd68b5a17003192c4
SHA1 2f8aafd332c10fe06a084692877dad297af03aa1
SHA512 b4012fcdbbbf12647e410bef11e092269b45b9d57dabbb467d43753c7097d5de9ef40fe0421f1d81945ed15d57470fd245b7bfc796280abc486477a2701ca260
SSDEEP 6291456:dzWDxHNUbxHOBEZRRbk6uJJ+nljgbAhEv8HCvfAvXA:VWDxQIl6uJMUbPv8UfAvXA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TemplatesAdobe-Type2.3.9.6.exe

Path \ProgramData\TemplatesAdobe-Type2.3.9.6\TemplatesAdobe-Type2.3.9.6.exe
Size 258.4MB
SHA256 8f6ff466e239600d86cf71f822efd1439035fd1ebb8f524c56cc5404942e6ead
MD5 08f1ecda39d4b0889ce4fb66a12706f0
SHA1 104c6484631f11c7c7c1b2c9a093d78ed635cd7b
SHA512 7560c5215b92712e36e9b0f9d7ce48cedb4e63c3c2d13a25b1589255a9d9304a3845e5a27314e3ff9885e0ec077efd7bdaa085f49a9821ea370fb0c6d4dfcd8e
SSDEEP 6291456:dzWDxHNUbxHOBEZRRbk6uJJ+nljgbAhEv8HCvfAvXR:VWDxQIl6uJMUbPv8UfAvXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

TemplatesAdobe-Type2.3.9.6.exe

Path \ProgramData\TemplatesAdobe-Type2.3.9.6\TemplatesAdobe-Type2.3.9.6.exe
Size 263.6MB
SHA256 56761598070fafc49a823199058fdcbab7ad2806a004e322d99b525161c3b42d
MD5 5c939727218c0f56eb1ce3af96bd1efd
SHA1 34b346a8d8988860cb2f2d572664e2c682a9e674
SHA512 e4c572ad8135d88687ace1480763c5a50f503362abd1ef2885eb042f99014710c45a2c5dc3627c01060be17249c0f4703b60cd0fb334deb48b40d4b24dbc9791
SSDEEP 6291456:dzWDxHNUbxHOBEZRRbk6uJJ+nljgbAhEv8HCvfAvX6:VWDxQIl6uJMUbPv8UfAvX6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1184-55-0x0000000000400000-0x0000000000862000-memory.dmp

Download

memory/1184-56-0x0000000000400000-0x0000000000862000-memory.dmp

Download

memory/1184-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1184-62-0x0000000000400000-0x0000000000862000-memory.dmp

Download

memory/1184-63-0x0000000000400000-0x0000000000862000-memory.dmp

Download

memory/1184-64-0x0000000004860000-0x00000000048A0000-memory.dmp

Download

memory/1184-65-0x0000000004860000-0x00000000048A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads