58428d81dab5ddde27d35078c1a775dc6bffa4a815dad9779e9f6eeaa19dd877

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2023, 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

M7R47913.exe
Size

7.0MB
MD5

d86486fdcc9747b5ccf9a246dfa727dd
SHA1

e580268cebc790fc7ec88cb019731f0c903a1a15
SHA256

58428d81dab5ddde27d35078c1a775dc6bffa4a815dad9779e9f6eeaa19dd877
SHA512

7555efdee463de2cffe2ea6afa1edf12cf5a2bc4ad752a88d361f1fca9b91e37db082317e98cea2554ede5e94a4d25e0a18075d32974ad8cb99f0cbc48d80f9a
SSDEEP

98304:Bo82lrwQnUKp8wut0BdTJAVp9jgeVpBiqLUBH76Pva0yTIpOmn2w9NAHr:ByfUew0BdaH3BfUKvac2aNS

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2552	MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run	M7R47913.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftSoftwareDistribution-SYQ237.1.8.6 = "C:\\ProgramData\\MicrosoftSoftwareDistribution-SYQ237.1.8.6\\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe"	M7R47913.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2552	548	M7R47913.exe	85
PID 548 wrote to memory of 2552	548	M7R47913.exe	85

C:\Users\Admin\AppData\Local\Temp\M7R47913.exe
"C:\Users\Admin\AppData\Local\Temp\M7R47913.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:548
- C:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe
  C:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe
  2⤵
  - Executes dropped EXE
  PID:2552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe

Filesize
757.0MB

MD5
e3c92a18d95db0083ec4e0e340a78a87

SHA1
42c2db1c711a58d9217c3055751913c8bf6d7c26

SHA256
108369cf181018332525f1a450577cc5d132e6d23e5644bd6184da2c230712ca

SHA512
4013d92596a2dfbca75e2cfb267cd97ce692b19862cb4509456ad3da98b7dffcd004f03a3c99d8cb43dda136307abdc1bfb9b7869e13383d362edc1de6fb91ab

Download Submit
C:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe

Filesize
757.0MB

MD5
e3c92a18d95db0083ec4e0e340a78a87

SHA1
42c2db1c711a58d9217c3055751913c8bf6d7c26

SHA256
108369cf181018332525f1a450577cc5d132e6d23e5644bd6184da2c230712ca

SHA512
4013d92596a2dfbca75e2cfb267cd97ce692b19862cb4509456ad3da98b7dffcd004f03a3c99d8cb43dda136307abdc1bfb9b7869e13383d362edc1de6fb91ab

Download Submit
memory/548-133-0x00007FF634D00000-0x00007FF635406000-memory.dmp

Filesize
7.0MB

Download
memory/2552-138-0x00007FF683D60000-0x00007FF684466000-memory.dmp

Filesize
7.0MB

Download