e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
04-10-2023 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe
Size

228KB
MD5

a6c1e2db747dff5dd0612807837b2d12
SHA1

4fd2708716a4f40c5306ce647c579c97953b5884
SHA256

e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d
SHA512

6221d42042b11fb3956248ee5d44af32e86b170cff9ddd95c52a85172f3a28a6a4a968d6c4ab8fc07c0b607607d3bb6286e8fb0785e62130021e6083150bbb1a
SSDEEP

6144:NptkCB5vkniiD067i+jMQXjRbtHppAOls7jbm:Npttvkii3iKX1btHX3s7m

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\clhav = "C:\\Users\\Admin\\AppData\\Roaming\\chdmv\\rbfotdyinws.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\e9c215e83bb6e46b8a29044e378bae7783ed14e3d5"	e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1792	2052	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1792	2052	e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe	29
PID 2052 wrote to memory of 1792	2052	e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe	29
PID 2052 wrote to memory of 1792	2052	e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe	29
PID 2052 wrote to memory of 1792	2052	e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d_JC.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 200
  2⤵
  - Program crash
  PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000000110000-0x0000000000112000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads