4b11345f599c34fa40d32bebbe4763034fb97b97dacf1993eff0e3c99dd73dfd

Analysis

max time kernel
6s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-05-2023 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trial autoreset.exe
Size

178KB
MD5

224fbfdb25aa26a626748a4b1bff537d
SHA1

5bed1ae77f8bb4e82a98c33781c05be0319dc6de
SHA256

4b11345f599c34fa40d32bebbe4763034fb97b97dacf1993eff0e3c99dd73dfd
SHA512

78b53909280f42758bb4dabea9602a873a238928ff5d7aaf4a009dd8c631acba5ede00cf9ca3844636fb2e6597978582640c8190a14a8b759ff713671c8101cf
SSDEEP

3072:xwxVMhOC/dTDbq91+mno3t4QZQ3rs2TTNTJTCN5gTGhSkT5dgsUGOgkBFVYbsVTZ:xTfFDbRnOTrEW0ct

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\intelitekreset = "reskey.bat"	regedit.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240542984	trial autoreset.exe
File created	C:\Windows\remkey.reg	trial autoreset.exe
File opened for modification	C:\Windows\remkey.reg	trial autoreset.exe
File created	C:\Windows\reskey.bat	trial autoreset.exe
File opened for modification	C:\Windows\reskey.bat	trial autoreset.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
1852	regedit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
352	trial autoreset.exe
352	trial autoreset.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 352 wrote to memory of 4188	352	trial autoreset.exe	66
PID 352 wrote to memory of 4188	352	trial autoreset.exe	66
PID 352 wrote to memory of 4188	352	trial autoreset.exe	66
PID 4188 wrote to memory of 1852	4188	cmd.exe	68
PID 4188 wrote to memory of 1852	4188	cmd.exe	68
PID 4188 wrote to memory of 1852	4188	cmd.exe	68

C:\Users\Admin\AppData\Local\Temp\trial autoreset.exe
"C:\Users\Admin\AppData\Local\Temp\trial autoreset.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\reskey.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s remkey.reg
    3⤵
    - Adds Run key to start application
    - Runs .reg file with regedit
    PID:1852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\remkey.reg

Filesize
480B

MD5
ce60d15b5cf5cec004e180bf6895dcd2

SHA1
7982a353a231311cd230e5cfe96d2170ee87eb1f

SHA256
cb388905bce903c41db4815f6dd3978d7746e27da29822c70d15be184cd98e05

SHA512
c75624cabb902ba7fe2821360b30bd352fe3e36ee30069a7909f112c63be7287e6b750ad86a2c5e2590f8a74a2e6e0ee801057eaac63d25024b1ffcd457e1927

Download Submit
C:\Windows\reskey.bat

Filesize
59B

MD5
63499244564d803ced1efcfa08d385cd

SHA1
33cc307e584588e0f6d10941e99c5ddce38dc264

SHA256
d5bef8f9ac790d33ab32bb906924d0b90fd7e3397cf24db4b200192069ae11df

SHA512
427c3572d86b7571e0d2e37c94c02d4d85988d528b0c124759e6e8c65e183883f8ceff8cb4829e922c1a73555376c5fc3b513772d3a2c06dccd2227d00f4334e

Download Submit
memory/352-127-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download