4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8

Analysis

max time kernel
60s
max time network
89s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
25/05/2023, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8.exe
Size

7.0MB
MD5

be4f1edcf0252ac6469d0b38e00bdff9
SHA1

8922420dbc3c6919180b9e9f35dfc87e2b196774
SHA256

4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8
SHA512

741c4d01ae4d90b52386b3e8c767167633b3c963e7d58ef4650448b390a6383c4b15149d6efedeee1885ea94e1a8b60a4c0c5a7c102ce4d8ee0f899d1af62e8e
SSDEEP

98304:oTp9BjCZBVA7mR1Vgkj2vH52ianzHcGC6K1NBa1r/ZFr0MPmR2g:YqZz1R1akpnzrnDTZPm

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5104	regid.1991-06.com.microsoftTemplates-U8I3.2.7.2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run	4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2 = "C:\\ProgramData\\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2\\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2.exe"	4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 5104	3532	4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8.exe	66
PID 3532 wrote to memory of 5104	3532	4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8.exe	66

C:\Users\Admin\AppData\Local\Temp\4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8.exe
"C:\Users\Admin\AppData\Local\Temp\4d3f46648c8ea6ec7304c7e41eea15112a97e8a50172041184b3e9ad878857a8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3532
- C:\ProgramData\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2.exe
  C:\ProgramData\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2.exe
  2⤵
  - Executes dropped EXE
  PID:5104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2.exe

Filesize
757.0MB

MD5
9a3ddde38ad92cfdb2017085a3db6d89

SHA1
1db26fb31ecd14682156ef1b4f1f47ab55f2c583

SHA256
c728ed8d3d7a104a54d58b52b9842d10d61c79a1bdbc4db73727cfb905c3a7a9

SHA512
c1808d6a145eef532ea8c371e43113ba9c9b45e3effbf9d25e7123465a3ad69319f9d20b5d5dbf128d9bfa8a5660ddf9176bb4e594780dc48662ef47f6912232

Download Submit
C:\ProgramData\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2\regid.1991-06.com.microsoftTemplates-U8I3.2.7.2.exe

Filesize
757.0MB

MD5
9a3ddde38ad92cfdb2017085a3db6d89

SHA1
1db26fb31ecd14682156ef1b4f1f47ab55f2c583

SHA256
c728ed8d3d7a104a54d58b52b9842d10d61c79a1bdbc4db73727cfb905c3a7a9

SHA512
c1808d6a145eef532ea8c371e43113ba9c9b45e3effbf9d25e7123465a3ad69319f9d20b5d5dbf128d9bfa8a5660ddf9176bb4e594780dc48662ef47f6912232

Download Submit
memory/3532-120-0x00007FF793510000-0x00007FF793C0D000-memory.dmp

Filesize
7.0MB

Download
memory/5104-125-0x00007FF6BAC60000-0x00007FF6BB35D000-memory.dmp

Filesize
7.0MB

Download