c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e

Analysis

max time kernel
87s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e.exe
Size

7.1MB
MD5

cede900aef57c8fe42f47f2b470d79c6
SHA1

e8e9cfa63234aac1188363c2bd5edeb4886370ed
SHA256

c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e
SHA512

6c8e42cbc91b42a8f7faf064b8f98ab3f07d85ffbc3b13b27fbf62b3a6a873c2e0e21a36df9cab5012a2bfa4dcfe1c7c5f62c2cf800229b51d42e8eed2e5e0c1
SSDEEP

98304:d+m2jN0EFKZ8h79UwDEif2lKzRGPuw1BRW0oGhW7a15Ru:dd2WcKG9UwDR2lKFG2ARW03W7URu

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3360	Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5 = "C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5.exe"	c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run	c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3360	3888	c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e.exe	80
PID 3888 wrote to memory of 3360	3888	c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e.exe	80

C:\Users\Admin\AppData\Local\Temp\c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e.exe
"C:\Users\Admin\AppData\Local\Temp\c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3888
- C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5.exe
  C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5.exe
  2⤵
  - Executes dropped EXE
  PID:3360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5.exe

Filesize
7.1MB

MD5
cede900aef57c8fe42f47f2b470d79c6

SHA1
e8e9cfa63234aac1188363c2bd5edeb4886370ed

SHA256
c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e

SHA512
6c8e42cbc91b42a8f7faf064b8f98ab3f07d85ffbc3b13b27fbf62b3a6a873c2e0e21a36df9cab5012a2bfa4dcfe1c7c5f62c2cf800229b51d42e8eed2e5e0c1

Download Submit
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38USOPrivate-E1R2.8.1.5.exe

Filesize
7.1MB

MD5
cede900aef57c8fe42f47f2b470d79c6

SHA1
e8e9cfa63234aac1188363c2bd5edeb4886370ed

SHA256
c00272de0bb9af51cddb7c3cf384f4fbc89a217d80b0d36b5fca197307d96a9e

SHA512
6c8e42cbc91b42a8f7faf064b8f98ab3f07d85ffbc3b13b27fbf62b3a6a873c2e0e21a36df9cab5012a2bfa4dcfe1c7c5f62c2cf800229b51d42e8eed2e5e0c1

Download Submit
memory/3360-138-0x00007FF77E370000-0x00007FF77EA80000-memory.dmp

Filesize
7.1MB

Download
memory/3888-133-0x00007FF7821C0000-0x00007FF7828D0000-memory.dmp

Filesize
7.1MB

Download