ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e.exe
Size

7.1MB
MD5

0a686e039746ca3cb1989e7b43eb5711
SHA1

19462b04593ec4dfc2a84dabbc2bde8609fc219f
SHA256

ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e
SHA512

dca105e96d9af841a9ca0a8d3fc99d703f5d064975d75ff48dc3eb3162ce42771ca5a7be8d34db9390400a2d5033830ff6fef674a49f4a5b6880f07234f21367
SSDEEP

98304:5xyvpfC+czPOF8It5KBOmJGNGXaujRJmP4X4NTgtK+5CIRHbM:5xyJak0BOSQGKaQCjM

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4456	DocumentsSoftwareDistribution-LOV1.0.3.8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows\CurrentVersion\Run	ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DocumentsSoftwareDistribution-LOV1.0.3.8 = "C:\\ProgramData\\DocumentsSoftwareDistribution-LOV1.0.3.8\\DocumentsSoftwareDistribution-LOV1.0.3.8.exe"	ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4456	4376	ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e.exe	81
PID 4376 wrote to memory of 4456	4376	ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e.exe	81

C:\Users\Admin\AppData\Local\Temp\ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e.exe
"C:\Users\Admin\AppData\Local\Temp\ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4376
- C:\ProgramData\DocumentsSoftwareDistribution-LOV1.0.3.8\DocumentsSoftwareDistribution-LOV1.0.3.8.exe
  C:\ProgramData\DocumentsSoftwareDistribution-LOV1.0.3.8\DocumentsSoftwareDistribution-LOV1.0.3.8.exe
  2⤵
  - Executes dropped EXE
  PID:4456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DocumentsSoftwareDistribution-LOV1.0.3.8\DocumentsSoftwareDistribution-LOV1.0.3.8.exe

Filesize
7.1MB

MD5
0a686e039746ca3cb1989e7b43eb5711

SHA1
19462b04593ec4dfc2a84dabbc2bde8609fc219f

SHA256
ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e

SHA512
dca105e96d9af841a9ca0a8d3fc99d703f5d064975d75ff48dc3eb3162ce42771ca5a7be8d34db9390400a2d5033830ff6fef674a49f4a5b6880f07234f21367

Download Submit
C:\ProgramData\DocumentsSoftwareDistribution-LOV1.0.3.8\DocumentsSoftwareDistribution-LOV1.0.3.8.exe

Filesize
7.1MB

MD5
0a686e039746ca3cb1989e7b43eb5711

SHA1
19462b04593ec4dfc2a84dabbc2bde8609fc219f

SHA256
ebf56a1723ce9d946c3e3e2f8332d265bb700761784532e700ab73a2ee39656e

SHA512
dca105e96d9af841a9ca0a8d3fc99d703f5d064975d75ff48dc3eb3162ce42771ca5a7be8d34db9390400a2d5033830ff6fef674a49f4a5b6880f07234f21367

Download Submit
memory/4376-133-0x00007FF712890000-0x00007FF712FA1000-memory.dmp

Filesize
7.1MB

Download
memory/4456-138-0x00007FF79C810000-0x00007FF79CF21000-memory.dmp

Filesize
7.1MB

Download