81471f1305575f28f1de8bffdaf11350da987542cac12f12c561cda0bf4fd089

Analysis

max time kernel
67s
max time network
70s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mapper.exe
Size

5.3MB
MD5

97d2822b1e3221cface2dcea55096d8c
SHA1

a856fb34bac6c30715f32162ae7a28311ffd098e
SHA256

81471f1305575f28f1de8bffdaf11350da987542cac12f12c561cda0bf4fd089
SHA512

fb89ae1e83ea5a656ed5e8e312eab81825d52a80bcb8fc07b8f314adf8192928d7fbd19ce596c31336b75b7e77d2f9a176d42fcd91620c042031dd1678b587db
SSDEEP

98304:QTuFltXQ05AkisVaCoK7YvLEEnXbixp4QYDsT/81x22mMbN:QeykiswCoDL6eH0/814p

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TSQkZoyBcOUBnRnuaAsNUMou\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\TSQkZoyBcOUBnRnuaAsNUMou"	mapper.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1416	mapper.exe
1416	mapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1416	mapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1416	mapper.exe

C:\Users\Admin\AppData\Local\Temp\mapper.exe
"C:\Users\Admin\AppData\Local\Temp\mapper.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-54-0x0000000077460000-0x0000000077462000-memory.dmp

Filesize
8KB

Download
memory/1416-55-0x0000000077460000-0x0000000077462000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x0000000077460000-0x0000000077462000-memory.dmp

Filesize
8KB

Download
memory/1416-57-0x000000013F370000-0x000000013FC68000-memory.dmp

Filesize
9.0MB

Download