73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b

Analysis

max time kernel
55s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
30/05/2023, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b.exe
Size

7.1MB
MD5

6bdb8c8d7807588d3e1cda75fdf81087
SHA1

4dc529184221e5c71d573e056302961b5c395cac
SHA256

73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b
SHA512

9cb2a184ff34fc2dc8ec9f14d08a458b2b0e3ecfd69b75252e9348a34a80dbdc06006318cbaa18c43ae5dc17533fa58fb114823f1098cd43610f4ac2b46bae42
SSDEEP

98304:bobEd1TVmHj8QFuI+YqOqZXZiv6E5abMQSqahqJJrMQcZ9g4kJ:bob6BmHjJMjocWbQcZ9P

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4112	USOPrivateDocuments-2OK7.1.0.2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run\USOPrivateDocuments-2OK7.1.0.2 = "C:\\ProgramData\\USOPrivateDocuments-2OK7.1.0.2\\USOPrivateDocuments-2OK7.1.0.2.exe"	73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4112	4036	73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b.exe	66
PID 4036 wrote to memory of 4112	4036	73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b.exe	66

C:\Users\Admin\AppData\Local\Temp\73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b.exe
"C:\Users\Admin\AppData\Local\Temp\73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4036
- C:\ProgramData\USOPrivateDocuments-2OK7.1.0.2\USOPrivateDocuments-2OK7.1.0.2.exe
  C:\ProgramData\USOPrivateDocuments-2OK7.1.0.2\USOPrivateDocuments-2OK7.1.0.2.exe
  2⤵
  - Executes dropped EXE
  PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\USOPrivateDocuments-2OK7.1.0.2\USOPrivateDocuments-2OK7.1.0.2.exe

Filesize
7.1MB

MD5
6bdb8c8d7807588d3e1cda75fdf81087

SHA1
4dc529184221e5c71d573e056302961b5c395cac

SHA256
73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b

SHA512
9cb2a184ff34fc2dc8ec9f14d08a458b2b0e3ecfd69b75252e9348a34a80dbdc06006318cbaa18c43ae5dc17533fa58fb114823f1098cd43610f4ac2b46bae42

Download Submit
C:\ProgramData\USOPrivateDocuments-2OK7.1.0.2\USOPrivateDocuments-2OK7.1.0.2.exe

Filesize
7.1MB

MD5
6bdb8c8d7807588d3e1cda75fdf81087

SHA1
4dc529184221e5c71d573e056302961b5c395cac

SHA256
73c14820b916aad0738a549f3f982c3304fe559dac67848d864e7002760cad5b

SHA512
9cb2a184ff34fc2dc8ec9f14d08a458b2b0e3ecfd69b75252e9348a34a80dbdc06006318cbaa18c43ae5dc17533fa58fb114823f1098cd43610f4ac2b46bae42

Download Submit
memory/4036-119-0x00007FF7DF2E0000-0x00007FF7DFA05000-memory.dmp

Filesize
7.1MB

Download
memory/4112-124-0x00007FF7503A0000-0x00007FF750AC5000-memory.dmp

Filesize
7.1MB

Download