af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d.exe
Size

7.0MB
MD5

29ec436d9593b807e0d2efa20dad4192
SHA1

f3b043bf60e512bc03d64b9568cd5d5d0d28da75
SHA256

af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d
SHA512

357f7e158ad96996e0f5a5ac9491646d5a18d09ba99185c6adce03b1a2d33d66854dfee39757bee408e80b01abeb062d9c5897e560801e0357f8e793313573fb
SSDEEP

196608:EBegQpHEsc0nQNFPOikUOaSLvVaFQ9IqLk0qaB0:EBEpdc028aa9mnkk0qw

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3248	PackagesWindowsHolographicDevices-9STC5.6.3.1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run	af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PackagesWindowsHolographicDevices-9STC5.6.3.1 = "C:\\ProgramData\\PackagesWindowsHolographicDevices-9STC5.6.3.1\\PackagesWindowsHolographicDevices-9STC5.6.3.1.exe"	af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3248	4268	af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d.exe	85
PID 4268 wrote to memory of 3248	4268	af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d.exe	85

C:\Users\Admin\AppData\Local\Temp\af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d.exe
"C:\Users\Admin\AppData\Local\Temp\af2c62cc34116709048e16220523ed3afcdcc9699fa9c28ef24cd37140d3cd0d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4268
- C:\ProgramData\PackagesWindowsHolographicDevices-9STC5.6.3.1\PackagesWindowsHolographicDevices-9STC5.6.3.1.exe
  C:\ProgramData\PackagesWindowsHolographicDevices-9STC5.6.3.1\PackagesWindowsHolographicDevices-9STC5.6.3.1.exe
  2⤵
  - Executes dropped EXE
  PID:3248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\PackagesWindowsHolographicDevices-9STC5.6.3.1\PackagesWindowsHolographicDevices-9STC5.6.3.1.exe

Filesize
757.0MB

MD5
e40803a00680763669df8ba6ea838e46

SHA1
481dfea0a86dc3eb013c4be51b5ee0b985057023

SHA256
5157bb1d18273056d29bbc6a987a0444d648569f1f1016443b706888ff2fed15

SHA512
4d527128ec928fb830541ae47f76c28c8a74b7dc422b8fd534fdf9dfd56c66a7fbfcd369172eb96488e57291638edb98527b818506f1b24e44b62721c2b93735

Download Submit
C:\ProgramData\PackagesWindowsHolographicDevices-9STC5.6.3.1\PackagesWindowsHolographicDevices-9STC5.6.3.1.exe

Filesize
757.0MB

MD5
e40803a00680763669df8ba6ea838e46

SHA1
481dfea0a86dc3eb013c4be51b5ee0b985057023

SHA256
5157bb1d18273056d29bbc6a987a0444d648569f1f1016443b706888ff2fed15

SHA512
4d527128ec928fb830541ae47f76c28c8a74b7dc422b8fd534fdf9dfd56c66a7fbfcd369172eb96488e57291638edb98527b818506f1b24e44b62721c2b93735

Download Submit
memory/3248-138-0x00007FF77EBE0000-0x00007FF77F2DD000-memory.dmp

Filesize
7.0MB

Download
memory/4268-133-0x00007FF63CBC0000-0x00007FF63D2BD000-memory.dmp

Filesize
7.0MB

Download