dc8c62af3c1a24ca65cca58140d4dc5bf555ef81cc7bdee46271b76f0a8e4c11

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ad17aa7cc8e24bc17487adcc003272d.exe
Size 52KB
Sample231231-gmgnfsabfj
SHA256 dc8c62af3c1a24ca65cca58140d4dc5bf555ef81cc7bdee46271b76f0a8e4c11
MD5 2ad17aa7cc8e24bc17487adcc003272d
SHA1 6718fc98af710d7a644aea1550ba4da6659b5e0f
SHA512 769a1999d97849cd326da59bf0c7fc3e24eb7c5cd748606cb38471b861d0e53002da0830c2a0778aa1d06affa0259fa5953ae5783ff941ac671edf232bd83052
SSDEEP 768:sPUShTFVU9lgIaXj+6ok0sikiGd5/eaj2B:scShEja6milG52
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
4844	mirwzntk.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mirwznt.dll	2ad17aa7cc8e24bc17487adcc003272d.exe
File created	C:\Windows\SysWOW64\mirwzntk.exe	2ad17aa7cc8e24bc17487adcc003272d.exe
File opened for modification	C:\Windows\SysWOW64\mirwzntk.exe	2ad17aa7cc8e24bc17487adcc003272d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4844	2468	2ad17aa7cc8e24bc17487adcc003272d.exe	90
PID 2468 wrote to memory of 4844	2468	2ad17aa7cc8e24bc17487adcc003272d.exe	90
PID 2468 wrote to memory of 4844	2468	2ad17aa7cc8e24bc17487adcc003272d.exe	90
PID 2468 wrote to memory of 4640	2468	2ad17aa7cc8e24bc17487adcc003272d.exe	94
PID 2468 wrote to memory of 4640	2468	2ad17aa7cc8e24bc17487adcc003272d.exe	94
PID 2468 wrote to memory of 4640	2468	2ad17aa7cc8e24bc17487adcc003272d.exe	94

C:\Users\Admin\AppData\Local\Temp\2ad17aa7cc8e24bc17487adcc003272d.exe
"C:\Users\Admin\AppData\Local\Temp\2ad17aa7cc8e24bc17487adcc003272d.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\mirwzntk.exe
  C:\Windows\system32\mirwzntk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2ad17aa7cc8e24bc17487adcc003272d.exe.bat
  2⤵
  PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2ad17aa7cc8e24bc17487adcc003272d.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\2ad17aa7cc8e24bc17487adcc003272d.exe.bat
Size 182B
SHA256 4c7000ed89aaa1f3f5c63da9b11dd81464915ffc7d390a8925babbbad97f31b9
MD5 bf955e2e5acd6d534dd6c2da77b2318e
SHA1 481d06a1186a126c674fe067af9c26eb4c4ecd4f
SHA512 c13c2576b86a59289cfd9024a1c60762770cdc4392e2b14ac92b515001d62e5f298f1f384b40d666c9c3f8e03838abf6d5fd20250a0d87cfff79430db9441dda
MD5 SHA1 SHA512

Submit Download

mirwzntk.exe

Path C:\Windows\SysWOW64\mirwzntk.exe
Size 52KB
SHA256 dc8c62af3c1a24ca65cca58140d4dc5bf555ef81cc7bdee46271b76f0a8e4c11
MD5 2ad17aa7cc8e24bc17487adcc003272d
SHA1 6718fc98af710d7a644aea1550ba4da6659b5e0f
SHA512 769a1999d97849cd326da59bf0c7fc3e24eb7c5cd748606cb38471b861d0e53002da0830c2a0778aa1d06affa0259fa5953ae5783ff941ac671edf232bd83052
SSDEEP 768:sPUShTFVU9lgIaXj+6ok0sikiGd5/eaj2B:scShEja6milG52
MD5 SHA1 SHA512 SSDEEP