111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa

Analysis

max time kernel
144s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
26/05/2023, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa.exe
Size

7.0MB
MD5

7c0c21883aba556e23146a360014aca1
SHA1

e44956f280905ff3314f9d5a1731fa0861005541
SHA256

111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa
SHA512

d563d8ce827a9d694cbf10ce22e58cb64a78a9f88df5e6c26632e85ec64e48915c5da842473f88f8c277e7f9be38e7d6c6f4bff0c2a40b57f72020840fe35ac0
SSDEEP

98304:h2tfr07WjN1A6onOP5LgX/TERwGVcoNoxam11BJfclo/KxuWOHZV1CECcvG3j:d7ocPOP5LgX7FCco6cgn/qOD1i

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3436	WindowsHolographicDevicesDocuments-VWX8.0.9.5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHolographicDevicesDocuments-VWX8.0.9.5 = "C:\\ProgramData\\WindowsHolographicDevicesDocuments-VWX8.0.9.5\\WindowsHolographicDevicesDocuments-VWX8.0.9.5.exe"	111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3436	4116	111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa.exe	66
PID 4116 wrote to memory of 3436	4116	111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa.exe	66

C:\Users\Admin\AppData\Local\Temp\111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa.exe
"C:\Users\Admin\AppData\Local\Temp\111a576aad6cfe66108bdf5141b64523413cb48fe5248a2f9d44ca057a26ddaa.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4116
- C:\ProgramData\WindowsHolographicDevicesDocuments-VWX8.0.9.5\WindowsHolographicDevicesDocuments-VWX8.0.9.5.exe
  C:\ProgramData\WindowsHolographicDevicesDocuments-VWX8.0.9.5\WindowsHolographicDevicesDocuments-VWX8.0.9.5.exe
  2⤵
  - Executes dropped EXE
  PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WindowsHolographicDevicesDocuments-VWX8.0.9.5\WindowsHolographicDevicesDocuments-VWX8.0.9.5.exe

Filesize
757.0MB

MD5
1f9d88439f4bd73cb97900ec60e1aa6d

SHA1
85b91db439e1c17d8cc51f7b375e94d69cea8e1e

SHA256
da70bd4bb360aaa11a6177924d7c2cfa5470ce21ee4ab9caabed45c1d98c25e4

SHA512
e67d9e6f1c67af15acf8dc0f0521c4c0ab2f3ec0fb4147306040924fe21f51740293f50d8bdd96adb2e0363037bbc33d8fcf13a57c2159f52581c5f996c49e23

Download Submit
C:\ProgramData\WindowsHolographicDevicesDocuments-VWX8.0.9.5\WindowsHolographicDevicesDocuments-VWX8.0.9.5.exe

Filesize
757.0MB

MD5
1f9d88439f4bd73cb97900ec60e1aa6d

SHA1
85b91db439e1c17d8cc51f7b375e94d69cea8e1e

SHA256
da70bd4bb360aaa11a6177924d7c2cfa5470ce21ee4ab9caabed45c1d98c25e4

SHA512
e67d9e6f1c67af15acf8dc0f0521c4c0ab2f3ec0fb4147306040924fe21f51740293f50d8bdd96adb2e0363037bbc33d8fcf13a57c2159f52581c5f996c49e23

Download Submit
memory/3436-124-0x00007FF736CC0000-0x00007FF7373BB000-memory.dmp

Filesize
7.0MB

Download
memory/4116-119-0x00007FF6ECDF0000-0x00007FF6ED4EB000-memory.dmp

Filesize
7.0MB

Download