37d9c4e523e17ea2111fa669884bf215b4103ebaa1b3cf93fa0b7cde3bbcef63

Analysis

max time kernel
127s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
differentdatabase.exe
Size 1.4MB
Sample231010-v7p28aha33
SHA256 37d9c4e523e17ea2111fa669884bf215b4103ebaa1b3cf93fa0b7cde3bbcef63
MD5 3f0ca10225ca292ea31be0d292dcfb70
SHA1 487d9e8360d9b6e3a1d060b679f79932f86ec3ad
SHA512 27d3eaa08ac8c65207125926510d8fb57b0639b51a23757edd0e548a3369a40582be5486e1aed3d40148be324067a8f6f55bf9c084feff4d102e1017537a648c
SSDEEP 24576:ohZyd7+ZwzrxQ9pz9GWAPQrbBICBaeLR0tEtg6jKgMjc:88QBpY2R0tEt7jKgMY
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\differentdatabase.exe"	differentdatabase.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3304 set thread context of 836	3304	differentdatabase.exe	100

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	differentdatabase.exe
3304	differentdatabase.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	differentdatabase.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 3528	3304	differentdatabase.exe	99
PID 3304 wrote to memory of 3528	3304	differentdatabase.exe	99
PID 3304 wrote to memory of 3528	3304	differentdatabase.exe	99
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100
PID 3304 wrote to memory of 836	3304	differentdatabase.exe	100

C:\Users\Admin\AppData\Local\Temp\differentdatabase.exe
"C:\Users\Admin\AppData\Local\Temp\differentdatabase.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Users\Admin\AppData\Local\Temp\differentdatabase.exe
  C:\Users\Admin\AppData\Local\Temp\differentdatabase.exe
  2⤵
  PID:3528
- C:\Users\Admin\AppData\Local\Temp\differentdatabase.exe
  C:\Users\Admin\AppData\Local\Temp\differentdatabase.exe
  2⤵
  - Adds Run key to start application
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

differentdatabase.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\differentdatabase.exe.log
Size 1KB
SHA256 10bf6242da02dad8b2e1208b9dab9a7303cf986320e05e5ef20b99c9b71326d4
MD5 489c7565f9b029ba9fadff774073cc98
SHA1 56c05089b33ee7e7dfa9e6a2d098164efd8e1150
SHA512 ddea09c011a8d4f85905842c2f34c98add0110a0b6b3b2709718c3614a2c42dec5f4f5d5b9442cfd3c6c23e9a90c8c0b25c14c3dbd42faea9cc8dd232cace1ac
MD5 SHA1 SHA512

Submit Download

memory/836-9-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/836-18-0x0000000002D30000-0x0000000002D40000-memory.dmp

Download

memory/836-17-0x0000000075310000-0x0000000075AC0000-memory.dmp

Download

memory/836-16-0x00000000051A0000-0x00000000051AA000-memory.dmp

Download

memory/836-15-0x0000000002D30000-0x0000000002D40000-memory.dmp

Download

memory/836-14-0x0000000005240000-0x00000000052D2000-memory.dmp

Download

memory/836-13-0x0000000075310000-0x0000000075AC0000-memory.dmp

Download

memory/3304-4-0x0000000006350000-0x000000000637C000-memory.dmp

Download

memory/3304-8-0x0000000006A50000-0x0000000006FF4000-memory.dmp

Download

memory/3304-12-0x0000000075310000-0x0000000075AC0000-memory.dmp

Download

memory/3304-7-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3304-6-0x0000000075310000-0x0000000075AC0000-memory.dmp

Download

memory/3304-5-0x0000000006400000-0x000000000644C000-memory.dmp

Download

memory/3304-1-0x0000000000810000-0x0000000000978000-memory.dmp

Download

memory/3304-3-0x00000000062F0000-0x000000000632E000-memory.dmp

Download

memory/3304-2-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/3304-0-0x0000000075310000-0x0000000075AC0000-memory.dmp

Download