564a3169d7900138b825a0296c0bcee7e9535b48ad9fc596469075a1b94c0c81

Analysis

max time kernel
146s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

704abaa25d34630c376dc3ead72ef392.exe
Size

96KB
MD5

704abaa25d34630c376dc3ead72ef392
SHA1

1d5d95f8fe013948f42721794d55b328eb0b2bc0
SHA256

564a3169d7900138b825a0296c0bcee7e9535b48ad9fc596469075a1b94c0c81
SHA512

dafa6343c8bf5bf49af7641deae993ca13e9978460ef210ff6b8f34a757009003a6e20b571204d81aecb2d42bdf6e431a5d83cf882b1c4e19a3bf36f648f5371
SSDEEP

1536:lloZi5h7oT5CF4j3wcCEzKYwNo4ZjLYLAtu:XoZi5h8IF4T0kKYiyAtu

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsofts = "C:\\Windows\\csrcs.exe"	704abaa25d34630c376dc3ead72ef392.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\csrcs.exe	704abaa25d34630c376dc3ead72ef392.exe
File opened for modification	C:\Windows\csrcs.exe	704abaa25d34630c376dc3ead72ef392.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1744	704abaa25d34630c376dc3ead72ef392.exe
2648	704abaa25d34630c376dc3ead72ef392.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28
PID 1744 wrote to memory of 2648	1744	704abaa25d34630c376dc3ead72ef392.exe	28

C:\Users\Admin\AppData\Local\Temp\704abaa25d34630c376dc3ead72ef392.exe
"C:\Users\Admin\AppData\Local\Temp\704abaa25d34630c376dc3ead72ef392.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\704abaa25d34630c376dc3ead72ef392.exe
  "C:\Users\Admin\AppData\Local\Temp\704abaa25d34630c376dc3ead72ef392.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\csrcs.exe

Filesize
96KB

MD5
704abaa25d34630c376dc3ead72ef392

SHA1
1d5d95f8fe013948f42721794d55b328eb0b2bc0

SHA256
564a3169d7900138b825a0296c0bcee7e9535b48ad9fc596469075a1b94c0c81

SHA512
dafa6343c8bf5bf49af7641deae993ca13e9978460ef210ff6b8f34a757009003a6e20b571204d81aecb2d42bdf6e431a5d83cf882b1c4e19a3bf36f648f5371

Download Submit
memory/1744-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1744-15-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2648-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2648-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-19-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-20-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2648-316-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads