a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Original/fax_390392029_072514.exe
Size

276KB
MD5

4ba43f0b82f86efed437c8523f7a4dee
SHA1

356b21b749c8bc5e2295a3db62ea03c47cb4c1cf
SHA256

10745182ac1b738e4a363166f650069d16b81873b3bbb1990e7d07cb652495e8
SHA512

b0d36313226069688e1710be561f6bb75e232ee35212d41b50e12800ef54c48fbe29b1e97d8d08add642714887a10d598a06cfd2b8a609556242689496ad82a0
SSDEEP

6144:NYIPjoJyR6dNNdUvw9IbxQi2qJ+4DhYxrtaDi:NY/eP9j2LvxaDi

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1032	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Windows\CurrentVersion\Run	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Local\\cmd.exe"	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\fax_390392029_072514.INI	fax_390392029_072514.exe
File opened for modification	C:\Windows\cmd.INI	cmd.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1032	cmd.exe
1032	cmd.exe
1032	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3160	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1032	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1328	fax_390392029_072514.exe
1328	fax_390392029_072514.exe
1032	cmd.exe
1032	cmd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3160	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1032	1328	fax_390392029_072514.exe	85
PID 1328 wrote to memory of 1032	1328	fax_390392029_072514.exe	85
PID 1328 wrote to memory of 1032	1328	fax_390392029_072514.exe	85

C:\Users\Admin\AppData\Local\Temp\Original\fax_390392029_072514.exe
"C:\Users\Admin\AppData\Local\Temp\Original\fax_390392029_072514.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Users\Admin\AppData\Local\cmd.exe
  C:\Users\Admin\AppData\Local\Temp\Original\fax_390392029_072514.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\cmd.exe

Filesize
276KB

MD5
4ba43f0b82f86efed437c8523f7a4dee

SHA1
356b21b749c8bc5e2295a3db62ea03c47cb4c1cf

SHA256
10745182ac1b738e4a363166f650069d16b81873b3bbb1990e7d07cb652495e8

SHA512
b0d36313226069688e1710be561f6bb75e232ee35212d41b50e12800ef54c48fbe29b1e97d8d08add642714887a10d598a06cfd2b8a609556242689496ad82a0

Download Submit
C:\Users\Admin\AppData\Local\cmd.exe

Filesize
276KB

MD5
4ba43f0b82f86efed437c8523f7a4dee

SHA1
356b21b749c8bc5e2295a3db62ea03c47cb4c1cf

SHA256
10745182ac1b738e4a363166f650069d16b81873b3bbb1990e7d07cb652495e8

SHA512
b0d36313226069688e1710be561f6bb75e232ee35212d41b50e12800ef54c48fbe29b1e97d8d08add642714887a10d598a06cfd2b8a609556242689496ad82a0

Download Submit
memory/1032-146-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1032-152-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1032-161-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1328-135-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1328-134-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/1328-144-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1328-133-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3160-159-0x0000000003010000-0x000000000303B000-memory.dmp

Filesize
172KB

Download
memory/3160-158-0x0000000003040000-0x000000000306E000-memory.dmp

Filesize
184KB

Download
memory/3160-156-0x0000000003040000-0x000000000306E000-memory.dmp

Filesize
184KB

Download
memory/3160-160-0x0000000003040000-0x000000000306E000-memory.dmp

Filesize
184KB

Download
memory/3160-163-0x0000000003040000-0x000000000306E000-memory.dmp

Filesize
184KB

Download