a88897a4da999ceb415df1220001d0e704ca2b4a265f61409209e717ea90eb8d

Analysis

max time kernel
144s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c7ddc7ae2e502fca72b2626ef0f6a8d.exe
Size

20KB
MD5

3c7ddc7ae2e502fca72b2626ef0f6a8d
SHA1

e319a050c2ec3ff32064cc7db54f6fd400a0234d
SHA256

a88897a4da999ceb415df1220001d0e704ca2b4a265f61409209e717ea90eb8d
SHA512

080266923198a2fb92c8cdcf9238aeff7f2e9e5d5e3283b3cde3f145cca55e7f19be9c08b750b0e06f0a8b96326a990c2a3da432593debe26871238d9c271f96
SSDEEP

192:/T0bABznOnhqO5lJn7ED3Z44m8GuqqwyDW4ny:/T0b+SnsOV7ED3Z44wu/nDW4y

Score

9^/10

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Runs net.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2364	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	23
PID 2552 wrote to memory of 2364	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	23
PID 2552 wrote to memory of 2364	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	23
PID 2364 wrote to memory of 5020	2364	net.exe	22
PID 2364 wrote to memory of 5020	2364	net.exe	22
PID 2364 wrote to memory of 5020	2364	net.exe	22
PID 2552 wrote to memory of 3716	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	103
PID 2552 wrote to memory of 3716	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	103
PID 2552 wrote to memory of 3716	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	103
PID 2552 wrote to memory of 3100	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	102
PID 2552 wrote to memory of 3100	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	102
PID 2552 wrote to memory of 3100	2552	3c7ddc7ae2e502fca72b2626ef0f6a8d.exe	102
PID 3716 wrote to memory of 2776	3716	net.exe	99
PID 3716 wrote to memory of 2776	3716	net.exe	99
PID 3716 wrote to memory of 2776	3716	net.exe	99
PID 3100 wrote to memory of 3488	3100	net.exe	98
PID 3100 wrote to memory of 3488	3100	net.exe	98
PID 3100 wrote to memory of 3488	3100	net.exe	98

C:\Users\Admin\AppData\Local\Temp\3c7ddc7ae2e502fca72b2626ef0f6a8d.exe
"C:\Users\Admin\AppData\Local\Temp\3c7ddc7ae2e502fca72b2626ef0f6a8d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\net.exe
  net user /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- C:\Windows\SysWOW64\net.exe
  net localgroup Administrators /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- C:\Windows\SysWOW64\net.exe
  net user /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user /del
1⤵
PID:5020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators /add
1⤵
PID:3488

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user /add
1⤵
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads