371f31966d6b3138e6a3e2e3c3a2b28f21438964e8fad479200b51b3f716202e

Analysis

max time kernel
0s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2af54d29d8a54bd16b8dc3ab5281b39d.exe
Size

194KB
MD5

2af54d29d8a54bd16b8dc3ab5281b39d
SHA1

d2a1ae8e648caca869ffdf986c52275408173250
SHA256

371f31966d6b3138e6a3e2e3c3a2b28f21438964e8fad479200b51b3f716202e
SHA512

47204c7d168a88072c3be431f682ec3fecd857e857716b041765af3b180e2c6c6c8c26ab09002f64c0eeb447f3cd76b50a354c86540c3c64efc10af12d6458f7
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/858RkgnYD:o68i3odBiTl2+TCU/86k8S

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	2af54d29d8a54bd16b8dc3ab5281b39d.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\winhash_up.exez	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File opened for modification	C:\Windows\winhash_up.exez	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\winhash_up.exe	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	2af54d29d8a54bd16b8dc3ab5281b39d.exe
File created	C:\Windows\bugMAKER.bat	2af54d29d8a54bd16b8dc3ab5281b39d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 408	1244	2af54d29d8a54bd16b8dc3ab5281b39d.exe	18
PID 1244 wrote to memory of 408	1244	2af54d29d8a54bd16b8dc3ab5281b39d.exe	18
PID 1244 wrote to memory of 408	1244	2af54d29d8a54bd16b8dc3ab5281b39d.exe	18

C:\Users\Admin\AppData\Local\Temp\2af54d29d8a54bd16b8dc3ab5281b39d.exe
"C:\Users\Admin\AppData\Local\Temp\2af54d29d8a54bd16b8dc3ab5281b39d.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
  2⤵
  PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
f8c7caaa442819c870d6178d9a5d6296

SHA1
da31f9f8e78c03351936ba363348add670bd31f8

SHA256
1f5465b47eef40f81a7a93e839538ed815595e6158945a4842b61b9f824d034f

SHA512
161c7a428418c4eb57554aa6e7975ec75feca3cd398721c2e455440e93b58d138df71f07a33da78cd14725fdc21e00430dd88105a88b6d255f7539e549744881

Download Submit
memory/1244-24-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads