f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2023 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4.exe
Size

7.1MB
MD5

c25f0a6a0f1e9466ddc074560a309df4
SHA1

00f056de59e1736ba3a71a2af173ea1270389e5c
SHA256

f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4
SHA512

dd7d169e2322a389c65137e66e23c4058d83bb4e14f810f54aa9efdaa50fb61f4cc39cbd067fbe4e5a717a05df5fdd40bda2616f0a45ff098c9f0bd61f08fca3
SSDEEP

98304:XR4d1vdm64Je7rPgc9VBSpe9Vx3/LSFiuRG9H2uAJL4:XRkFmvEvoUjVZdeGPgL

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4168	regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run	f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4 = "C:\\ProgramData\\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4\\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4.exe"	f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 4168	2076	f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4.exe	83
PID 2076 wrote to memory of 4168	2076	f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4.exe	83

C:\Users\Admin\AppData\Local\Temp\f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4.exe
"C:\Users\Admin\AppData\Local\Temp\f09d0ae7aa5d2b5bfc653d0811d0685116057982848e858ca06a7a061183bbe4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076
- C:\ProgramData\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4.exe
  C:\ProgramData\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4.exe
  2⤵
  - Executes dropped EXE
  PID:4168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4.exe

Filesize
757.1MB

MD5
cc4f1b94d2a60a30039412dba5c04220

SHA1
b6756aaa5768f8a7e05cf1806a578efac12bc7b7

SHA256
d8e136104295af7c9b26bc2b1fa0714cf45b6cc4d3957129cdd9aad96962b1f7

SHA512
5ff20fa5b6278dbbc49f84d517ccfcb585822551ac6d98cb53674ed07e01cfb9adbe3bf6c3d5d0d16fdd44fda67badaac96043e9d275de8fa1eeba38ca9b9281

Download Submit
C:\ProgramData\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4\regid.1991-06.com.microsoftDocuments-S7CFJ6.3.8.4.exe

Filesize
757.1MB

MD5
cc4f1b94d2a60a30039412dba5c04220

SHA1
b6756aaa5768f8a7e05cf1806a578efac12bc7b7

SHA256
d8e136104295af7c9b26bc2b1fa0714cf45b6cc4d3957129cdd9aad96962b1f7

SHA512
5ff20fa5b6278dbbc49f84d517ccfcb585822551ac6d98cb53674ed07e01cfb9adbe3bf6c3d5d0d16fdd44fda67badaac96043e9d275de8fa1eeba38ca9b9281

Download Submit
memory/2076-133-0x00007FF6ED5E0000-0x00007FF6EDCF8000-memory.dmp

Filesize
7.1MB

Download
memory/4168-138-0x00007FF6B0CE0000-0x00007FF6B13F8000-memory.dmp

Filesize
7.1MB

Download