6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b

Analysis

max time kernel
150s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/05/2023, 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
Size

145KB
MD5

2ef95efdbedb353a82497ab63aa39067
SHA1

a7784438c0ca3e37d63fc409435f6a5e96f73f41
SHA256

6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b
SHA512

1c053e93ffb29b7ef556e898650e447e8f3c101e5eb491fdd68adebc98434745b69fabf959db3d5fb0993b2be8c06f448d0b031de88024d7a4d37fdcab8dbfad
SSDEEP

3072:X3gonQnBpzMo4JPj5hMVXUgbRZlIwTqeq+3r7E4sf65NiJtmghrOy7BCRIVCNfD0:nDnyMVIZLT

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bvsqlki = "\"C:\\Users\\Admin\\AppData\\Roaming\\Gltkij\\Bvsqlki.exe\""	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
332	powershell.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
Token: SeDebugPrivilege	332	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
960	AcroRd32.exe
960	AcroRd32.exe
960	AcroRd32.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 332	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	28
PID 1408 wrote to memory of 332	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	28
PID 1408 wrote to memory of 332	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	28
PID 1408 wrote to memory of 332	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	28
PID 1408 wrote to memory of 960	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	30
PID 1408 wrote to memory of 960	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	30
PID 1408 wrote to memory of 960	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	30
PID 1408 wrote to memory of 960	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	30
PID 1408 wrote to memory of 1356	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	31
PID 1408 wrote to memory of 1356	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	31
PID 1408 wrote to memory of 1356	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	31
PID 1408 wrote to memory of 1356	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	31
PID 1408 wrote to memory of 108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	32
PID 1408 wrote to memory of 108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	32
PID 1408 wrote to memory of 108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	32
PID 1408 wrote to memory of 108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	32
PID 1408 wrote to memory of 808	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	33
PID 1408 wrote to memory of 808	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	33
PID 1408 wrote to memory of 808	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	33
PID 1408 wrote to memory of 808	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	33
PID 1408 wrote to memory of 272	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	34
PID 1408 wrote to memory of 272	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	34
PID 1408 wrote to memory of 272	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	34
PID 1408 wrote to memory of 272	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	34
PID 1408 wrote to memory of 1360	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	35
PID 1408 wrote to memory of 1360	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	35
PID 1408 wrote to memory of 1360	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	35
PID 1408 wrote to memory of 1360	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	35
PID 1408 wrote to memory of 648	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	36
PID 1408 wrote to memory of 648	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	36
PID 1408 wrote to memory of 648	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	36
PID 1408 wrote to memory of 648	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	36
PID 1408 wrote to memory of 1728	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	37
PID 1408 wrote to memory of 1728	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	37
PID 1408 wrote to memory of 1728	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	37
PID 1408 wrote to memory of 1728	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	37
PID 1408 wrote to memory of 1108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	38
PID 1408 wrote to memory of 1108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	38
PID 1408 wrote to memory of 1108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	38
PID 1408 wrote to memory of 1108	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	38
PID 1408 wrote to memory of 1336	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	39
PID 1408 wrote to memory of 1336	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	39
PID 1408 wrote to memory of 1336	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	39
PID 1408 wrote to memory of 1336	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	39
PID 1408 wrote to memory of 848	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	40
PID 1408 wrote to memory of 848	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	40
PID 1408 wrote to memory of 848	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	40
PID 1408 wrote to memory of 848	1408	6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe	40

C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
"C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:332
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Mvhddbbjwgdqlpsquote .pdf"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:960
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:1356
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:108
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:808
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:272
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:648
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:1108
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:1336
- C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  C:\Users\Admin\AppData\Local\Temp\6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b.exe
  2⤵
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Mvhddbbjwgdqlpsquote .pdf

Filesize
95KB

MD5
b39397d02b8cdafec5e6ea4f98210a76

SHA1
44dc7358e5540457d3c2527c45f943ae12024df2

SHA256
cbad00d956559d07d590b06652062e43c6e786b3506e3c3fafcda962ea5c59ac

SHA512
afbcaca434a99b91ed6abbe83ebd9763c5345febb76f134ee030a63c0768c87a684dbc7063048d8629e62a62b321b44220921a759ffce516a26128e39f1eb22d

Download Submit
memory/332-61-0x0000000002760000-0x00000000027A0000-memory.dmp

Filesize
256KB

Download
memory/332-62-0x0000000002760000-0x00000000027A0000-memory.dmp

Filesize
256KB

Download
memory/332-63-0x0000000002760000-0x00000000027A0000-memory.dmp

Filesize
256KB

Download
memory/1408-54-0x00000000003F0000-0x000000000041A000-memory.dmp

Filesize
168KB

Download
memory/1408-55-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download
memory/1408-56-0x0000000006280000-0x00000000063BE000-memory.dmp

Filesize
1.2MB

Download
memory/1408-57-0x00000000002D0000-0x000000000032E000-memory.dmp

Filesize
376KB

Download
memory/1408-58-0x0000000005980000-0x0000000005A12000-memory.dmp

Filesize
584KB

Download
memory/1408-64-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

Filesize
256KB

Download