2eb27879a5518e7d67946a21f42462578c2c050a792ec2f2b87fd13e3682fbbf

Analysis

max time kernel
187s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08c9302ef5c4f49db326f9f9a4b17f56.exe
Size

59KB
MD5

08c9302ef5c4f49db326f9f9a4b17f56
SHA1

a48f23bac82eed8c1249238737dbcb785e8928b1
SHA256

2eb27879a5518e7d67946a21f42462578c2c050a792ec2f2b87fd13e3682fbbf
SHA512

aebe872c1ddfaf87e5f4ebd188956cbdaf41e56ffa20cde544b581f20f81d26f3a5c1f729233648aa6c262a0794cc4bde9ef3db6e0ba7c74acbd1c84fa25d3e2
SSDEEP

1536:nrhSPNNZiBJRrwxmA2xEjr0D2NhJXAmp6T:nNSPlGJRk/ECIT

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\reprea\Parameters\ServiceDll = "%SystemRoot%\\System32\\tacppv.dll"	08c9302ef5c4f49db326f9f9a4b17f56.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\reprea\Parameters\ServiceDll = "%SystemRoot%\\System32\\tacppv.dll"	08c9302ef5c4f49db326f9f9a4b17f56.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\reprea\Parameters\ServiceDll = "%SystemRoot%\\System32\\tacppv.dll"	08c9302ef5c4f49db326f9f9a4b17f56.exe

Deletes itself 1 IoCs

pid	Process
3320	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
3132	08c9302ef5c4f49db326f9f9a4b17f56.exe
3320	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\00061544.ini	08c9302ef5c4f49db326f9f9a4b17f56.exe
File created	C:\Windows\SysWOW64\tacppv.dll	08c9302ef5c4f49db326f9f9a4b17f56.exe

C:\Users\Admin\AppData\Local\Temp\08c9302ef5c4f49db326f9f9a4b17f56.exe
"C:\Users\Admin\AppData\Local\Temp\08c9302ef5c4f49db326f9f9a4b17f56.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:3132

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k reprea
1⤵
- Deletes itself
- Loads dropped DLL
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tacppv.dll

Filesize
89KB

MD5
9462cb48dcc5e0879420df74591923ce

SHA1
ecf5c7b8f5a6a9f11279b3a5cf3bf727bee5c55c

SHA256
8bfcbe0b99bb96cc441ed827251c2c3ae70ac830355182b31ef35dc719d7e27b

SHA512
72f420a17fc59002b00a66609cd3518c8b417e9e4677ac7e17861ad4160ffb18761756596900cfdd688e917515f2a80d882aa91762db00f9094a7c7672fa6960

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads