a8d550940dae4f776b69d2f3a2d5c5e806683360a27db091664fb77968632cc5

Analysis

max time kernel
2s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

208d28e43c0f56aa003e779ed86a3648.exe
Size

18KB
MD5

208d28e43c0f56aa003e779ed86a3648
SHA1

aa800229fef21568708a7906de82d62619bc33e4
SHA256

a8d550940dae4f776b69d2f3a2d5c5e806683360a27db091664fb77968632cc5
SHA512

d1f83b68a62ca904f7d96f39382c5cd32f66181f4ff10d8309fa71d58a2afe77405f532274be4358334149f8d36c04bfe5681d229e1b706339590d19ebdce96d
SSDEEP

384:R4Aja+mt5FjZPV3cIsLAz6i8szU7DjVNFJk5O0D7hGU7/0PMLqr:+ANmLlZP+LAz78szmDjXT2pD7R0PMLq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3680	208d28e43c0f56aa003e779ed86a3648.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SHAProc = "C:\\Windows\\SHAProc.exe"	208d28e43c0f56aa003e779ed86a3648.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SHAProc.dat	208d28e43c0f56aa003e779ed86a3648.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SHAProc.exe	208d28e43c0f56aa003e779ed86a3648.exe
File created	C:\Windows\SHAProc.exe	208d28e43c0f56aa003e779ed86a3648.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3680	208d28e43c0f56aa003e779ed86a3648.exe
3680	208d28e43c0f56aa003e779ed86a3648.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3680	208d28e43c0f56aa003e779ed86a3648.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 3444	3680	208d28e43c0f56aa003e779ed86a3648.exe	44
PID 3680 wrote to memory of 3444	3680	208d28e43c0f56aa003e779ed86a3648.exe	44

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\208d28e43c0f56aa003e779ed86a3648.exe
  "C:\Users\Admin\AppData\Local\Temp\208d28e43c0f56aa003e779ed86a3648.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3680

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1640

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3668

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\SHAProc.dat

Filesize
32KB

MD5
d5e3bf1395e14d6a3e3876974add6d0c

SHA1
ed78cdbb4da5d4eca5bdf3ec86c29f0997b8a1f9

SHA256
3fd86ff48c28fc4841b30e9f8ecd6e2db74e3aa1eb5e483d88e9b603e6718b2d

SHA512
e01b7768d1e337dfb11f0ecb295667f437c7a3560bbf7bf6d37c9a3f2aff93eea2db8f3f5141487216a146216e30e686edbcb605e75b827044a25ba90ca8d5fc

Download Submit
memory/3444-3-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/3680-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3680-6-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3680-9-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download