dc59d5c1001df8271925781c33dd7360fe27fb750357107f12844fb5903bc65a

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
22-07-2023 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

863e7c22c771e4005197ae28363584f8.exe
Size

117KB
MD5

863e7c22c771e4005197ae28363584f8
SHA1

c2b6309eaf265e8f727ae416c3e2dc80c85093c3
SHA256

dc59d5c1001df8271925781c33dd7360fe27fb750357107f12844fb5903bc65a
SHA512

05bc0242c05edf415e1a623af6e594bc659e9973ff8214bb1d62a959004a0fdc25253c6ca4cae79e45857f826f825b1f5a7d820af0faa86bc6734ba06f624b55
SSDEEP

1536:i+TFehW6kk7PW6uZ7rSGFJVnmnMHOUc1D9SKD3wgz4/3INHOubF:VaPW6w3SGFJ9mnMSD9SKEgA4/F

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Document Viewer\\setview.exe\""	863e7c22c771e4005197ae28363584f8.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2620	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2300	863e7c22c771e4005197ae28363584f8.exe
2300	863e7c22c771e4005197ae28363584f8.exe
2300	863e7c22c771e4005197ae28363584f8.exe
2300	863e7c22c771e4005197ae28363584f8.exe
2300	863e7c22c771e4005197ae28363584f8.exe
2300	863e7c22c771e4005197ae28363584f8.exe
2300	863e7c22c771e4005197ae28363584f8.exe
2300	863e7c22c771e4005197ae28363584f8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2140	2300	863e7c22c771e4005197ae28363584f8.exe	28
PID 2300 wrote to memory of 2140	2300	863e7c22c771e4005197ae28363584f8.exe	28
PID 2300 wrote to memory of 2140	2300	863e7c22c771e4005197ae28363584f8.exe	28
PID 2300 wrote to memory of 2620	2300	863e7c22c771e4005197ae28363584f8.exe	29
PID 2300 wrote to memory of 2620	2300	863e7c22c771e4005197ae28363584f8.exe	29
PID 2300 wrote to memory of 2620	2300	863e7c22c771e4005197ae28363584f8.exe	29

C:\Users\Admin\AppData\Local\Temp\863e7c22c771e4005197ae28363584f8.exe
"C:\Users\Admin\AppData\Local\Temp\863e7c22c771e4005197ae28363584f8.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\863e7c22c771e4005197ae28363584f8.exe
  C:\Users\Admin\AppData\Local\Temp\863e7c22c771e4005197ae28363584f8.exe 2300
  2⤵
  PID:2140
- C:\Windows\system32\systeminfo.exe
  systeminfo.exe
  2⤵
  - Gathers system information
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2300-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2300-65-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download