29a4eb606592d90906521b476a877a2c55ecf3c091497718c5ee163d64798a42

Analysis

max time kernel
62s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ef253deea81edebd9ccf54cab8dbf51.exe
Size

18KB
MD5

3ef253deea81edebd9ccf54cab8dbf51
SHA1

5d95054cafff8b96dc29d2e67d66c533450fca18
SHA256

29a4eb606592d90906521b476a877a2c55ecf3c091497718c5ee163d64798a42
SHA512

53e669ffd4aabcb034067cd025177cf6bc30bd4bfe5d52c2c187a26e548ac71bf2ca9f17f4b5f43504509fd0f40954ed271bc1f5c292d51dcdefcb355b7a4c69
SSDEEP

384:mSW/W/QSnGOu51jY++wbLvsEBCwN3HppQ5CR6kX7UFHELVfzkbr4:8eu1jTjF3Hpe5sAHgQr4

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\A3542120\ImagePath = "C:\\Windows\\system32\\A3542120.EXE -p"	3ef253deea81edebd9ccf54cab8dbf51.exe

Executes dropped EXE 1 IoCs

pid	Process
1464	A3542120.EXE

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\A3542120.EXE	3ef253deea81edebd9ccf54cab8dbf51.exe
File opened for modification	C:\Windows\SysWOW64\A3542120.EXE	3ef253deea81edebd9ccf54cab8dbf51.exe
File created	C:\Windows\SysWOW64\A3542120.EXE	A3542120.EXE
File created	C:\Windows\SysWOW64\A3542120.DLL	A3542120.EXE
File created	C:\Windows\SysWOW64\delme.bat	3ef253deea81edebd9ccf54cab8dbf51.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	A3542120.EXE
1464	A3542120.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3008	3ef253deea81edebd9ccf54cab8dbf51.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 840	3008	3ef253deea81edebd9ccf54cab8dbf51.exe	102
PID 3008 wrote to memory of 840	3008	3ef253deea81edebd9ccf54cab8dbf51.exe	102
PID 3008 wrote to memory of 840	3008	3ef253deea81edebd9ccf54cab8dbf51.exe	102

C:\Users\Admin\AppData\Local\Temp\3ef253deea81edebd9ccf54cab8dbf51.exe
"C:\Users\Admin\AppData\Local\Temp\3ef253deea81edebd9ccf54cab8dbf51.exe"
1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\delme.bat
  2⤵
  PID:840

C:\Windows\SysWOW64\A3542120.EXE
C:\Windows\SysWOW64\A3542120.EXE -p
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\A3542120.EXE

Filesize
18KB

MD5
3ef253deea81edebd9ccf54cab8dbf51

SHA1
5d95054cafff8b96dc29d2e67d66c533450fca18

SHA256
29a4eb606592d90906521b476a877a2c55ecf3c091497718c5ee163d64798a42

SHA512
53e669ffd4aabcb034067cd025177cf6bc30bd4bfe5d52c2c187a26e548ac71bf2ca9f17f4b5f43504509fd0f40954ed271bc1f5c292d51dcdefcb355b7a4c69

Download Submit
C:\Windows\SysWOW64\delme.bat

Filesize
211B

MD5
e99dd5f7d3f7c0f10c0b2609a06f2ff6

SHA1
aaef76ec0ef8136aa0a839ca981458b77817910d

SHA256
91309b13372eb625abcf7866eb492dae3fcdde726158422db3b93eff938c8ffa

SHA512
11509929b43c8bf25cb5ee9493f005b75c6e9dc0e230b180c51d8b0a27f57c597b4690662914b5667bd88a052239166429806255028b02d1fe368143d4368e3c

Download Submit
memory/1464-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1464-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3008-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3008-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/3008-2-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3008-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download