6d816f68418de557b9c98067ddbe01771d1fa929c02a6d3b369f6ddcb07ad2b1

Analysis

max time kernel
101s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2023, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.5MB
MD5

c145368f4a398c1e079452402f19e558
SHA1

bfef72b62570b4998afe15e429d55b026a4c97b6
SHA256

6d816f68418de557b9c98067ddbe01771d1fa929c02a6d3b369f6ddcb07ad2b1
SHA512

48a1da0a96aafdcfae4b40a6391574eed56026237e64c256ba884ed1376371a5c4029fdf1baec601d3b5ea1698b11c3b6f410c0a09127d6cfa6e076d361048e7
SSDEEP

12288:xaWvxinENAuEp9I+PRAxI+Rahx6k2nBhpL0EUqMDxIrH6o7fThewQk4phLteeHrd:xaWvOX

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
1072	AppLaunch.exe
1072	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1072	2040	file.exe	91

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AppLaunch.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1072	AppLaunch.exe
1072	AppLaunch.exe
1072	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	file.exe
Token: SeDebugPrivilege	1072	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1072	2040	file.exe	91
PID 2040 wrote to memory of 1072	2040	file.exe	91
PID 2040 wrote to memory of 1072	2040	file.exe	91
PID 2040 wrote to memory of 1072	2040	file.exe	91
PID 2040 wrote to memory of 1072	2040	file.exe	91
PID 2040 wrote to memory of 1072	2040	file.exe	91
PID 2040 wrote to memory of 1072	2040	file.exe	91
PID 2040 wrote to memory of 1072	2040	file.exe	91

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6381714705684532372624.tmp

Filesize
144KB

MD5
085d53138aa94f3a47cc193adf641838

SHA1
7976e33f3130597f4747267ef092ed1d625df340

SHA256
537d431a2c01d03de1ca3b1bdc38af462bfd80197429084afe346a0780502e58

SHA512
ca513a462552f55824549d51b4e7d53fea7453a94a5127e5984b87a634a8b15d9d47f4a527eb41193d2a264e662cea902ca266ed4e3cd294c2a2851170a32a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\6381714705684532372624.tmp

Filesize
144KB

MD5
085d53138aa94f3a47cc193adf641838

SHA1
7976e33f3130597f4747267ef092ed1d625df340

SHA256
537d431a2c01d03de1ca3b1bdc38af462bfd80197429084afe346a0780502e58

SHA512
ca513a462552f55824549d51b4e7d53fea7453a94a5127e5984b87a634a8b15d9d47f4a527eb41193d2a264e662cea902ca266ed4e3cd294c2a2851170a32a67

Download Submit
memory/1072-145-0x0000000005580000-0x00000000055AA000-memory.dmp

Filesize
168KB

Download
memory/1072-138-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1072-140-0x0000000005620000-0x0000000005630000-memory.dmp

Filesize
64KB

Download
memory/1072-148-0x0000000005F60000-0x0000000006504000-memory.dmp

Filesize
5.6MB

Download
memory/1072-159-0x00000000068F0000-0x0000000006982000-memory.dmp

Filesize
584KB

Download
memory/1072-161-0x00000000079F0000-0x0000000007BB2000-memory.dmp

Filesize
1.8MB

Download
memory/2040-136-0x000000000A8A0000-0x000000000A8C2000-memory.dmp

Filesize
136KB

Download
memory/2040-137-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/2040-135-0x000000000A470000-0x000000000A4D6000-memory.dmp

Filesize
408KB

Download
memory/2040-134-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/2040-133-0x0000000000240000-0x00000000003BE000-memory.dmp

Filesize
1.5MB

Download