1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
31s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe
Size

657KB
MD5

582f17fc7c96a8b86c4610ac7d61c78c
SHA1

cd873543b014547928e8ae4a4879b5023e978483
SHA256

96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1
SHA512

8286d23c63b66a9f6a19efe59db5ba9c51ddcb5dd3a68194043395879db8e116765481f435629c28db6b3d8c7f71b0249212b4df6abedc3b086226b423a98803
SSDEEP

6144:gdnECeEwzQSj2tcxZdOFaFkvm9MoSQgj2x+zofMmpUpdaRsrSlLOkWcn7xJ:hCpwzQSj2th/uKoSkNfrUXIm46khNJ

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2136	smss.cmd

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Systool = "C:\\Windows\\smss.cmd"	96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\smss.cmd	96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe
File opened for modification	C:\Windows\smss.cmd	96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe
File created	C:\Windows\smss.cmd	smss.cmd
File opened for modification	C:\Windows\smss.cmd	smss.cmd

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2136	2376	96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe	28
PID 2376 wrote to memory of 2136	2376	96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe	28
PID 2376 wrote to memory of 2136	2376	96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe	28
PID 2376 wrote to memory of 2136	2376	96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe	28

C:\Users\Admin\AppData\Local\Temp\96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe
"C:\Users\Admin\AppData\Local\Temp\96f295d08c64e21aa847dcff5d942dd2beec65fa4957a6690ee2b7b79382cdd1.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\smss.cmd
  C:\Windows\smss.cmd
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\smss.cmd

Filesize
657KB

MD5
c42183da43073ac5a1c06749a98f071a

SHA1
3e6302304ed26813994bcc5f7210fa6dc40de519

SHA256
5ce58a4f693c376dd9804b56fb9b3540bdbcbb1f660d9f701e083198fd7c4fad

SHA512
e3ba1bb06387929cdad37dedca12edd37dd914917e67fbdefc7a6a95338231d4aa661dbb637964733920619a500d90b58b115acbaa77a16e3aa3e818661c1f14

Download Submit
C:\Windows\smss.cmd

Filesize
657KB

MD5
c42183da43073ac5a1c06749a98f071a

SHA1
3e6302304ed26813994bcc5f7210fa6dc40de519

SHA256
5ce58a4f693c376dd9804b56fb9b3540bdbcbb1f660d9f701e083198fd7c4fad

SHA512
e3ba1bb06387929cdad37dedca12edd37dd914917e67fbdefc7a6a95338231d4aa661dbb637964733920619a500d90b58b115acbaa77a16e3aa3e818661c1f14

Download Submit
C:\Windows\smss.cmd

Filesize
657KB

MD5
c42183da43073ac5a1c06749a98f071a

SHA1
3e6302304ed26813994bcc5f7210fa6dc40de519

SHA256
5ce58a4f693c376dd9804b56fb9b3540bdbcbb1f660d9f701e083198fd7c4fad

SHA512
e3ba1bb06387929cdad37dedca12edd37dd914917e67fbdefc7a6a95338231d4aa661dbb637964733920619a500d90b58b115acbaa77a16e3aa3e818661c1f14

Download Submit
memory/2136-10-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2136-13-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2376-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2376-12-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads