e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c

Analysis

max time kernel
123s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c.exe
Size

7.0MB
MD5

aef383489bd555ea5038f91444f0d8d5
SHA1

cf31821c9ac1997d313aa098bd73567e2aad0fe9
SHA256

e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c
SHA512

360397eec612748984a724c61d01a53faeff3880949b9d88cceab80e8bdd93e8fe75af3d0c5209578370e88717fe75255d0bf3a125137b033ff073b4355f0ef6
SSDEEP

98304:dA0pJCKJmv/eWa1W96l2Z26LTVHwVeD2ywtHqk+zsJA1/XDq+6:dA028mnuD2ZlN2eDPwQffDe

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1996	DocumentsPackages-JRL2.7.6.3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run	e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DocumentsPackages-JRL2.7.6.3 = "C:\\ProgramData\\DocumentsPackages-JRL2.7.6.3\\DocumentsPackages-JRL2.7.6.3.exe"	e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1996	2544	e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c.exe	82
PID 2544 wrote to memory of 1996	2544	e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c.exe	82

C:\Users\Admin\AppData\Local\Temp\e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c.exe
"C:\Users\Admin\AppData\Local\Temp\e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2544
- C:\ProgramData\DocumentsPackages-JRL2.7.6.3\DocumentsPackages-JRL2.7.6.3.exe
  C:\ProgramData\DocumentsPackages-JRL2.7.6.3\DocumentsPackages-JRL2.7.6.3.exe
  2⤵
  - Executes dropped EXE
  PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DocumentsPackages-JRL2.7.6.3\DocumentsPackages-JRL2.7.6.3.exe

Filesize
7.0MB

MD5
aef383489bd555ea5038f91444f0d8d5

SHA1
cf31821c9ac1997d313aa098bd73567e2aad0fe9

SHA256
e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c

SHA512
360397eec612748984a724c61d01a53faeff3880949b9d88cceab80e8bdd93e8fe75af3d0c5209578370e88717fe75255d0bf3a125137b033ff073b4355f0ef6

Download Submit
C:\ProgramData\DocumentsPackages-JRL2.7.6.3\DocumentsPackages-JRL2.7.6.3.exe

Filesize
7.0MB

MD5
aef383489bd555ea5038f91444f0d8d5

SHA1
cf31821c9ac1997d313aa098bd73567e2aad0fe9

SHA256
e37eaa4b99fb255cd047a0432c75a0b54982cea8e85da0fcef8cc71eb301d40c

SHA512
360397eec612748984a724c61d01a53faeff3880949b9d88cceab80e8bdd93e8fe75af3d0c5209578370e88717fe75255d0bf3a125137b033ff073b4355f0ef6

Download Submit
memory/1996-138-0x00007FF68FFC0000-0x00007FF6906CA000-memory.dmp

Filesize
7.0MB

Download
memory/2544-133-0x00007FF6B4760000-0x00007FF6B4E6A000-memory.dmp

Filesize
7.0MB

Download