e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe
Size

1.1MB
MD5

123f982d1e61cad9310eb705cc974287
SHA1

b0a3882492b30928b800a5bca927a07225ad7b7c
SHA256

e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629
SHA512

85f6b58de947076d84946ae7e23efbf7ae14ed942815779aa58de06e9a46f70a4401e96eea50bfa92db17d14084c6b5e6a3b893e1ecdd48f2628f38459f2e256
SSDEEP

24576:zYFbkIsaPiXSVnC7Yp9zkNmZG8RRlndyzF:zYREXSVMDi3Q

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\240604140.bat"	look2.exe

Executes dropped EXE 2 IoCs

pid	Process
4544	look2.exe
4856	svchcst.exe

Loads dropped DLL 3 IoCs

pid	Process
4544	look2.exe
4324	svchost.exe
4856	svchcst.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File created	C:\Windows\SysWOW64\240604140.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1004	e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe
1004	e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4544	1004	e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe	22
PID 1004 wrote to memory of 4544	1004	e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe	22
PID 1004 wrote to memory of 4544	1004	e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe	22
PID 4324 wrote to memory of 4856	4324	svchost.exe	95
PID 4324 wrote to memory of 4856	4324	svchost.exe	95
PID 4324 wrote to memory of 4856	4324	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe
"C:\Users\Admin\AppData\Local\Temp\e59aa0e715834770776a4e0ec7c571c43346b66a831dbfaa0d783b06928c4629.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\look2.exe
  C:\Users\Admin\AppData\Local\Temp\\look2.exe
  2⤵
  - Sets DLL path for service in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:4544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:1440

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\240604140.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
92KB

MD5
c8558026278c4b864c451f3eef43bd7b

SHA1
044015ebbc993458b9c93577e8fb6d6e7bf8568b

SHA256
eb17989f5ea42d37c8d45ab6c7fbaffad830c9a852b212cbf04de4a924a103ee

SHA512
62d23464d64cec2c2b1703f1bfb7e5e1e15f03d4b777725ff2e93408604efcf3b22d26ec3a4abc847ddb2f39a5ef935612296c2c318b73f5350679a6a2b4b794

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads