73d7f5bdab71a22467b79e95c5258a99a8c50fcac8ddd3b7d0d97251be11b057

Analysis

max time kernel
24s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2023, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13b8945cb1717cae1351ec72893d8359_JC.exe
Size 436KB
Sample230918-vcw72sda87
SHA256 73d7f5bdab71a22467b79e95c5258a99a8c50fcac8ddd3b7d0d97251be11b057
MD5 13b8945cb1717cae1351ec72893d8359
SHA1 5fd88a39a66decead6a1cf78822138590f766800
SHA512 3cedb5cd00b4005acc72db575b2f72a6cb088b8efa237b11899c4757898f3a46984dee1e86f62cf6eb9aad8a58eea75d203d4fb9b36067f2cc8e9385681de213
SSDEEP 6144:WcNhJgX9z9TB0YRX8nwhKy4K612iXPMX98L6DFu3:phJ6nTOYREYK46zi9lDM3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1632	MSWDM.EXE
4184	MSWDM.EXE
836	13B8945CB1717CAE1351EC72893D8359_JC.EXE
236	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	13b8945cb1717cae1351ec72893d8359_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	13b8945cb1717cae1351ec72893d8359_JC.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	13b8945cb1717cae1351ec72893d8359_JC.exe
File opened for modification	C:\Windows\devDDDD.tmp	13b8945cb1717cae1351ec72893d8359_JC.exe
File opened for modification	C:\Windows\devDDDD.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	MSWDM.EXE
4184	MSWDM.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1632	1540	13b8945cb1717cae1351ec72893d8359_JC.exe	81
PID 1540 wrote to memory of 1632	1540	13b8945cb1717cae1351ec72893d8359_JC.exe	81
PID 1540 wrote to memory of 1632	1540	13b8945cb1717cae1351ec72893d8359_JC.exe	81
PID 1540 wrote to memory of 4184	1540	13b8945cb1717cae1351ec72893d8359_JC.exe	82
PID 1540 wrote to memory of 4184	1540	13b8945cb1717cae1351ec72893d8359_JC.exe	82
PID 1540 wrote to memory of 4184	1540	13b8945cb1717cae1351ec72893d8359_JC.exe	82
PID 4184 wrote to memory of 836	4184	MSWDM.EXE	84
PID 4184 wrote to memory of 836	4184	MSWDM.EXE	84
PID 4184 wrote to memory of 836	4184	MSWDM.EXE	84
PID 4184 wrote to memory of 236	4184	MSWDM.EXE	86
PID 4184 wrote to memory of 236	4184	MSWDM.EXE	86
PID 4184 wrote to memory of 236	4184	MSWDM.EXE	86

C:\Users\Admin\AppData\Local\Temp\13b8945cb1717cae1351ec72893d8359_JC.exe
"C:\Users\Admin\AppData\Local\Temp\13b8945cb1717cae1351ec72893d8359_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1540
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1632
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devDDDD.tmp!C:\Users\Admin\AppData\Local\Temp\13b8945cb1717cae1351ec72893d8359_JC.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Users\Admin\AppData\Local\Temp\13B8945CB1717CAE1351EC72893D8359_JC.EXE
    3⤵
    - Executes dropped EXE
    PID:836
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devDDDD.tmp!C:\Users\Admin\AppData\Local\Temp\13B8945CB1717CAE1351EC72893D8359_JC.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13B8945CB1717CAE1351EC72893D8359_JC.EXE

Path C:\Users\Admin\AppData\Local\Temp\13B8945CB1717CAE1351EC72893D8359_JC.EXE
Size 436KB
SHA256 c1d0846ac01092cb2ae7bcd231414d2a16de837e162217f649b2ac87d66f38af
MD5 a551b2de93cc6986eca838e42a3572c9
SHA1 cfce70d846053a75a187782fa3799cb1964c9d2f
SHA512 1ecff867b53c66a94877492ce52607d1e7740773abb4e4111da2b749fdc3e6ca304eb32bd87d8475d6a0ddb1599a8d51fd99922b2ee87a34c3ab718eaa2c0823
SSDEEP 6144:WcNhJgX9z9TB0YRX8nwhKy4K612iXPMX98L6DFu0:phJ6nTOYREYK46zi9lDM0
MD5 SHA1 SHA512 SSDEEP

Submit Download

13B8945CB1717CAE1351EC72893D8359_JC.EXE

Path C:\Users\Admin\AppData\Local\Temp\13B8945CB1717CAE1351EC72893D8359_JC.EXE
Size 436KB
SHA256 c1d0846ac01092cb2ae7bcd231414d2a16de837e162217f649b2ac87d66f38af
MD5 a551b2de93cc6986eca838e42a3572c9
SHA1 cfce70d846053a75a187782fa3799cb1964c9d2f
SHA512 1ecff867b53c66a94877492ce52607d1e7740773abb4e4111da2b749fdc3e6ca304eb32bd87d8475d6a0ddb1599a8d51fd99922b2ee87a34c3ab718eaa2c0823
SSDEEP 6144:WcNhJgX9z9TB0YRX8nwhKy4K612iXPMX98L6DFu0:phJ6nTOYREYK46zi9lDM0
MD5 SHA1 SHA512 SSDEEP

Submit Download

13b8945cb1717cae1351ec72893d8359_JC.exe

Path C:\Users\Admin\AppData\Local\Temp\13b8945cb1717cae1351ec72893d8359_JC.exe
Size 180KB
SHA256 40395ba22b299a55ef82685598efb2fef316a97835d0aea8759274ac3521266c
MD5 af6cdb55f9e419169b784a59ab1f7fc5
SHA1 31e3b9d2742eed03c6209a7ff9f7a56a62384b72
SHA512 cfea00fb62164a790e6f4b9f54e2e6f3975f5e45d0cc5e94b4dbee9d38d6304d3cc970d307842ab9e800bf0597a9f828e22bfb8c0ee8477f79a64230362df4ac
SSDEEP 3072:1brJKy5StK6qvOEviMSCIaqMX8iOS8zLXW3qITalMHLFbgYwRfnC:1hKy4K612iXPMX98L6DFu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

13b8945cb1717cae1351ec72893d8359_JC.exe

Path C:\Users\Admin\AppData\Local\Temp\13b8945cb1717cae1351ec72893d8359_JC.exe
Size 436KB
SHA256 c1d0846ac01092cb2ae7bcd231414d2a16de837e162217f649b2ac87d66f38af
MD5 a551b2de93cc6986eca838e42a3572c9
SHA1 cfce70d846053a75a187782fa3799cb1964c9d2f
SHA512 1ecff867b53c66a94877492ce52607d1e7740773abb4e4111da2b749fdc3e6ca304eb32bd87d8475d6a0ddb1599a8d51fd99922b2ee87a34c3ab718eaa2c0823
SSDEEP 6144:WcNhJgX9z9TB0YRX8nwhKy4K612iXPMX98L6DFu0:phJ6nTOYREYK46zi9lDM0
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\WINDOWS\MSWDM.EXE
Size 256KB
SHA256 5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
MD5 8a1198209520897514a2d82a912a66d2
SHA1 5dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA512 9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
SSDEEP 3072:WcX93xwq19gL2SjGojCJa79TBfsY5vXWqvuHcYnLzqP2o:WcNhJgX9z9TB0YRX8nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 256KB
SHA256 5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
MD5 8a1198209520897514a2d82a912a66d2
SHA1 5dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA512 9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
SSDEEP 3072:WcX93xwq19gL2SjGojCJa79TBfsY5vXWqvuHcYnLzqP2o:WcNhJgX9z9TB0YRX8nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 256KB
SHA256 5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
MD5 8a1198209520897514a2d82a912a66d2
SHA1 5dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA512 9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
SSDEEP 3072:WcX93xwq19gL2SjGojCJa79TBfsY5vXWqvuHcYnLzqP2o:WcNhJgX9z9TB0YRX8nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 256KB
SHA256 5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0
MD5 8a1198209520897514a2d82a912a66d2
SHA1 5dda8ec47f948814d808cd71e89ebe65940a1ff7
SHA512 9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00
SSDEEP 3072:WcX93xwq19gL2SjGojCJa79TBfsY5vXWqvuHcYnLzqP2o:WcNhJgX9z9TB0YRX8nG
MD5 SHA1 SHA512 SSDEEP

Submit Download

devDDDD.tmp

Path C:\Windows\devDDDD.tmp
Size 180KB
SHA256 40395ba22b299a55ef82685598efb2fef316a97835d0aea8759274ac3521266c
MD5 af6cdb55f9e419169b784a59ab1f7fc5
SHA1 31e3b9d2742eed03c6209a7ff9f7a56a62384b72
SHA512 cfea00fb62164a790e6f4b9f54e2e6f3975f5e45d0cc5e94b4dbee9d38d6304d3cc970d307842ab9e800bf0597a9f828e22bfb8c0ee8477f79a64230362df4ac
SSDEEP 3072:1brJKy5StK6qvOEviMSCIaqMX8iOS8zLXW3qITalMHLFbgYwRfnC:1hKy4K612iXPMX98L6DFu0
MD5 SHA1 SHA512 SSDEEP

Submit Download