c23e6c7e98562de77fc4b33a7e0f9095f066014017411ce29c32e4838fee4e1b

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a027109cfcd7a759f568cf715f65e110_exe32.exe
Size

58KB
MD5

a027109cfcd7a759f568cf715f65e110
SHA1

adbfa54df5d03813c5f2d59c6fc583a2bb7f0ac1
SHA256

c23e6c7e98562de77fc4b33a7e0f9095f066014017411ce29c32e4838fee4e1b
SHA512

cbb128b14d82006e5617dee00d0d28180a3f42619e1cd123ea3c1927a9eeaa0b008a0ab2f3d7c89b000c4d27547d41e3e3f9f89b943d9206770360f45db14b84
SSDEEP

1536:yeQHqwIpZSW/382OpSdjRBfUR+WomI6guisKldP:ZG6ZFPcp8jfUR+5mYz7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	a027109cfcd7a759f568cf715f65e110_exe32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	a027109cfcd7a759f568cf715f65e110_exe32.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	a027109cfcd7a759f568cf715f65e110_exe32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2964	2112	a027109cfcd7a759f568cf715f65e110_exe32.exe	28
PID 2112 wrote to memory of 2964	2112	a027109cfcd7a759f568cf715f65e110_exe32.exe	28
PID 2112 wrote to memory of 2964	2112	a027109cfcd7a759f568cf715f65e110_exe32.exe	28
PID 2112 wrote to memory of 2964	2112	a027109cfcd7a759f568cf715f65e110_exe32.exe	28
PID 2112 wrote to memory of 1260	2112	a027109cfcd7a759f568cf715f65e110_exe32.exe	14
PID 2112 wrote to memory of 1260	2112	a027109cfcd7a759f568cf715f65e110_exe32.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\a027109cfcd7a759f568cf715f65e110_exe32.exe
  "C:\Users\Admin\AppData\Local\Temp\a027109cfcd7a759f568cf715f65e110_exe32.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\a027109cfcd7a759f568cf715f65e110_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\a027109cfcd7a759f568cf715f65e110_exe32.exe"
    3⤵
    PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-3-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/1260-4-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/2112-0-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/2112-5-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download
memory/2964-1-0x0000000001000000-0x000000000100F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads