9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7

Analysis

max time kernel
149s
max time network
153s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
26-05-2023 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7.exe
Size

7.0MB
MD5

5ade4c5e2ae02cce9521877035b76cab
SHA1

3a0267c4812c610604362d100def325f864d70d9
SHA256

9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7
SHA512

17a16bc1d21e79261ffdc61f753021e798c62ae38222fabec557cf0bd98e86a9fcdaca3b2bb46b0f1020f10ed6cbce9db3e658cab4f2925b4d7d8f1ba9fa4f3e
SSDEEP

98304:qqGObHVGt3tyNUonMrp/bxbAYO3YMpvW8mAMuKpsRK1gGyiGl8lv:LV+3GnGNb+WNNsReRm8

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1504	SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1 = "C:\\ProgramData\\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1\\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1.exe"	9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 1504	352	9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7.exe	66
PID 352 wrote to memory of 1504	352	9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7.exe	66

C:\Users\Admin\AppData\Local\Temp\9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7.exe
"C:\Users\Admin\AppData\Local\Temp\9526a386b7f3a77bf2f5b7ca4a9cb38c9986a0281be2452857153b58ebf979d7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:352
- C:\ProgramData\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1.exe
  C:\ProgramData\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1.exe
  2⤵
  - Executes dropped EXE
  PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1.exe

Filesize
757.0MB

MD5
02e53c18309b694a0490906dd22ac4da

SHA1
8ba425e1d94787ca2d836bda8694437a0630f28e

SHA256
15c4fa8c42f2aaffef7b938582a40515e9b23b13bede3796fea3171544256e82

SHA512
9710f502d51d7a93d7e9bf57ff20b86e7c7cc179992c0e2c908f13c474bf41d5fb843e296cc62484dc3d57bdb55b33b38e8dc30a32c161cb611060559ed701ce

Download Submit
C:\ProgramData\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1\SoftwareDistributionWindowsHolographicDevices-S32R6.6.4.1.exe

Filesize
757.0MB

MD5
02e53c18309b694a0490906dd22ac4da

SHA1
8ba425e1d94787ca2d836bda8694437a0630f28e

SHA256
15c4fa8c42f2aaffef7b938582a40515e9b23b13bede3796fea3171544256e82

SHA512
9710f502d51d7a93d7e9bf57ff20b86e7c7cc179992c0e2c908f13c474bf41d5fb843e296cc62484dc3d57bdb55b33b38e8dc30a32c161cb611060559ed701ce

Download Submit
memory/352-119-0x00007FF6A72B0000-0x00007FF6A79B3000-memory.dmp

Filesize
7.0MB

Download
memory/1504-124-0x00007FF7DEFB0000-0x00007FF7DF6B3000-memory.dmp

Filesize
7.0MB

Download