79198e97e7cb4d8d70333bd042ebf72e0ed05199a5b3ee6a0f2763b997a0eb84

Analysis

max time kernel
107s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa8615c5504befcbc1f4ce79192a61d2.exe
Size

12KB
MD5

fa8615c5504befcbc1f4ce79192a61d2
SHA1

1e263d11dececbea3c38ad1e70deecf60126b250
SHA256

79198e97e7cb4d8d70333bd042ebf72e0ed05199a5b3ee6a0f2763b997a0eb84
SHA512

0b8be5d6938efa2d0b206cc6e64938e20e2a04c3d66705599dd1c6e740eeb92efa0d34e2c42e3b814186c6965858921d656db300289ca35827cd473617851c83
SSDEEP

384:0gX0VjE9t5K4gqSLAz+FA+qPyiNpY2x6AxT+:NX0+DpSLZA+4pY66WT+

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1944	ravcqmon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ravcqmon = "C:\\Program Files\\NetMeeting\\ravcqmon.exe"	ravcqmon.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\NetMeeting\ravcqmon.exe	fa8615c5504befcbc1f4ce79192a61d2.exe
File created	C:\Program Files\NetMeeting\ravcqmon.exe	fa8615c5504befcbc1f4ce79192a61d2.exe
File opened for modification	C:\Program Files\NetMeeting\ravcqmon.cfg	fa8615c5504befcbc1f4ce79192a61d2.exe
File opened for modification	C:\Program Files\NetMeeting\ravcqmon.dat	ravcqmon.exe
File created	C:\Program Files\NetMeeting\ravcqmon.dat	ravcqmon.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
968	fa8615c5504befcbc1f4ce79192a61d2.exe
968	fa8615c5504befcbc1f4ce79192a61d2.exe
968	fa8615c5504befcbc1f4ce79192a61d2.exe
968	fa8615c5504befcbc1f4ce79192a61d2.exe
1944	ravcqmon.exe
1944	ravcqmon.exe
1944	ravcqmon.exe
1944	ravcqmon.exe
1944	ravcqmon.exe
1944	ravcqmon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	ravcqmon.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 1944	968	fa8615c5504befcbc1f4ce79192a61d2.exe	21
PID 968 wrote to memory of 1944	968	fa8615c5504befcbc1f4ce79192a61d2.exe	21
PID 968 wrote to memory of 1944	968	fa8615c5504befcbc1f4ce79192a61d2.exe	21
PID 1944 wrote to memory of 3472	1944	ravcqmon.exe	51
PID 968 wrote to memory of 5004	968	fa8615c5504befcbc1f4ce79192a61d2.exe	20
PID 968 wrote to memory of 5004	968	fa8615c5504befcbc1f4ce79192a61d2.exe	20
PID 968 wrote to memory of 5004	968	fa8615c5504befcbc1f4ce79192a61d2.exe	20

C:\Users\Admin\AppData\Local\Temp\fa8615c5504befcbc1f4ce79192a61d2.exe
"C:\Users\Admin\AppData\Local\Temp\fa8615c5504befcbc1f4ce79192a61d2.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\fa8615c5504befcbc1f4ce79192a61d2.exe"
  2⤵
  PID:5004
- C:\Program Files\NetMeeting\ravcqmon.exe
  "C:\Program Files\NetMeeting\ravcqmon.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1944

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads