Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2023 02:25
Static task
static1
Behavioral task
behavioral1
Sample
9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe
Resource
win10v2004-20230703-en
General
-
Target
9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe
-
Size
1.6MB
-
MD5
9e4ed2fc2e6e8dda280bcd28a7bb2a69
-
SHA1
ec2619b5bd65c054c28a1a1165c0a5361b8bafeb
-
SHA256
9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0
-
SHA512
b702a20cd162603424f132e5367b8eeb1dced5529e48926f0e4cab9589725618f5ea162b903dc7f48f708b17c7b28a90e11ad9c1e815b54d6926434230dfb868
-
SSDEEP
24576:3LILY8Xu/3y8UsG2BgYLicwnkwCHdebUKyZURQ1TgjTp:wYrC8UsGuTwVCHdeQKyZURQ1EjTp
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mls = "\"C:\\Users\\Admin\\AppData\\Roaming\\RAC\\mls.exe\" -s" 9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings 9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 948 WINWORD.EXE 948 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
WINWORD.EXEpid process 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE 948 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exedescription pid process target process PID 3596 wrote to memory of 948 3596 9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe WINWORD.EXE PID 3596 wrote to memory of 948 3596 9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe"C:\Users\Admin\AppData\Local\Temp\9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.docx" /o ""2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1800810909.tmpFilesize
1.6MB
MD59e4ed2fc2e6e8dda280bcd28a7bb2a69
SHA1ec2619b5bd65c054c28a1a1165c0a5361b8bafeb
SHA2569d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0
SHA512b702a20cd162603424f132e5367b8eeb1dced5529e48926f0e4cab9589725618f5ea162b903dc7f48f708b17c7b28a90e11ad9c1e815b54d6926434230dfb868
-
C:\Users\Admin\AppData\Local\Temp\9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.docxFilesize
21KB
MD58869610891b0191e9746909ca47ab2d8
SHA18cb8a15d92c4f21de8d057a50b1947555781b703
SHA256143e0f9934eeb25d2187e3e36f5dcbf2331266781e83ab9e3f73bbd295e539d5
SHA512678a1ed385d85709f5205091b03aabde8a4626a1b372911c97d59b60ec38ff4a39098f851d4f07229d2bdd48ee946ab14e010bad961af34588ea3249133870a3
-
C:\Users\Admin\AppData\Local\Temp\9d443259ea8d51ae9526311553ca27292739b41f0e41221e5da8e4680dad86c0.docxFilesize
21KB
MD58869610891b0191e9746909ca47ab2d8
SHA18cb8a15d92c4f21de8d057a50b1947555781b703
SHA256143e0f9934eeb25d2187e3e36f5dcbf2331266781e83ab9e3f73bbd295e539d5
SHA512678a1ed385d85709f5205091b03aabde8a4626a1b372911c97d59b60ec38ff4a39098f851d4f07229d2bdd48ee946ab14e010bad961af34588ea3249133870a3
-
memory/948-162-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-164-0x00007FFE7EDA0000-0x00007FFE7EDB0000-memory.dmpFilesize
64KB
-
memory/948-154-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-155-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-156-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-153-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-158-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-157-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-159-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-160-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-161-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-150-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-163-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-152-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-165-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-166-0x00007FFE7EDA0000-0x00007FFE7EDB0000-memory.dmpFilesize
64KB
-
memory/948-151-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-176-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-177-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-178-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-179-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB
-
memory/948-205-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-207-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-206-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-208-0x00007FFE81650000-0x00007FFE81660000-memory.dmpFilesize
64KB
-
memory/948-209-0x00007FFEC15D0000-0x00007FFEC17C5000-memory.dmpFilesize
2.0MB