d02cddc3ab9442d4b5f9dc6238b6b64003fe22d6f6d4c60f3f04462b5b0da887

Analysis

max time kernel
147s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

22a0d03004ce9192ccac0a5376c88f95.exe
Size

28KB
MD5

22a0d03004ce9192ccac0a5376c88f95
SHA1

63a6108932ee27dab26b62dcdd96908a26983d73
SHA256

d02cddc3ab9442d4b5f9dc6238b6b64003fe22d6f6d4c60f3f04462b5b0da887
SHA512

7ca78e5ac1bdb9572e27de8f9b3b99194a4470c05102ede582291aff12ecf7278d49c2b641a91735a6b9d409bb6fd007070ed057c44710dfa06f93a183d3a780
SSDEEP

768:2JF6G7mgAzcqYqMpSunLlzHeHa5H5J46Wo8cnLj:2j6edA4zRYZ6Wo8cn

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
516	ctfmon32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows svchost = "ctfmon32.exe"	22a0d03004ce9192ccac0a5376c88f95.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ctfmon32.exe	22a0d03004ce9192ccac0a5376c88f95.exe
File opened for modification	C:\Windows\ctfmon32.exe	22a0d03004ce9192ccac0a5376c88f95.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 516	4544	22a0d03004ce9192ccac0a5376c88f95.exe	21
PID 4544 wrote to memory of 516	4544	22a0d03004ce9192ccac0a5376c88f95.exe	21
PID 4544 wrote to memory of 516	4544	22a0d03004ce9192ccac0a5376c88f95.exe	21

C:\Users\Admin\AppData\Local\Temp\22a0d03004ce9192ccac0a5376c88f95.exe
"C:\Users\Admin\AppData\Local\Temp\22a0d03004ce9192ccac0a5376c88f95.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\ctfmon32.exe
  "C:\Windows\ctfmon32.exe"
  2⤵
  - Executes dropped EXE
  PID:516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ctfmon32.exe

Filesize
28KB

MD5
22a0d03004ce9192ccac0a5376c88f95

SHA1
63a6108932ee27dab26b62dcdd96908a26983d73

SHA256
d02cddc3ab9442d4b5f9dc6238b6b64003fe22d6f6d4c60f3f04462b5b0da887

SHA512
7ca78e5ac1bdb9572e27de8f9b3b99194a4470c05102ede582291aff12ecf7278d49c2b641a91735a6b9d409bb6fd007070ed057c44710dfa06f93a183d3a780

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads