e36cb035ff11e87c466b76472f468269e2ad19164c1d12002cd4ac69053bb076

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 05:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8e607ebd16af501429495aef19bc04a1.exe
Size

88KB
MD5

8e607ebd16af501429495aef19bc04a1
SHA1

d6c8593f989ecd09fdd3fd58a9dbf62897b5d290
SHA256

e36cb035ff11e87c466b76472f468269e2ad19164c1d12002cd4ac69053bb076
SHA512

8cafd3b543abf2232b4bf908d692c046a84271bd988c51a1ebdd7b368c268049f42eff63e4bc523d90b19a56a06e40ea86f6d8cf94e69b560e4464f2e7342bc2
SSDEEP

1536:FVVSE4fsaoIUtNXAzGV4EvhWpxu3K7472RDoNOUGp6ff55L:LVSE4f5opfzVWpPnhp6ff55L

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8e607ebd16af501429495aef19bc04a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Spool = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\spoolsv.exe /waitservice"	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8e607ebd16af501429495aef19bc04a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClipSrv = "C:\\Users\\Admin\\AppData\\Roaming\\clipsrv.exe /waitservice"	8e607ebd16af501429495aef19bc04a1.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	spoolsv.exe

Loads dropped DLL 2 IoCs

pid	Process
804	8e607ebd16af501429495aef19bc04a1.exe
804	8e607ebd16af501429495aef19bc04a1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mstsc.exe	8e607ebd16af501429495aef19bc04a1.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	8e607ebd16af501429495aef19bc04a1.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	8e607ebd16af501429495aef19bc04a1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mstsc = "C:\\Windows\\mstsc.exe /waitservice"	8e607ebd16af501429495aef19bc04a1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 2992	804	8e607ebd16af501429495aef19bc04a1.exe	28
PID 804 wrote to memory of 2992	804	8e607ebd16af501429495aef19bc04a1.exe	28
PID 804 wrote to memory of 2992	804	8e607ebd16af501429495aef19bc04a1.exe	28
PID 804 wrote to memory of 2992	804	8e607ebd16af501429495aef19bc04a1.exe	28

C:\Users\Admin\AppData\Local\Temp\8e607ebd16af501429495aef19bc04a1.exe
"C:\Users\Admin\AppData\Local\Temp\8e607ebd16af501429495aef19bc04a1.exe"
1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:804
- C:\Users\Admin\LOCALS~1\APPLIC~1\spoolsv.exe
  C:\Users\Admin\LOCALS~1\APPLIC~1\spoolsv.exe /waitservice
  2⤵
  - Executes dropped EXE
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MICROS~1\spoolsv.exe

Filesize
88KB

MD5
8e607ebd16af501429495aef19bc04a1

SHA1
d6c8593f989ecd09fdd3fd58a9dbf62897b5d290

SHA256
e36cb035ff11e87c466b76472f468269e2ad19164c1d12002cd4ac69053bb076

SHA512
8cafd3b543abf2232b4bf908d692c046a84271bd988c51a1ebdd7b368c268049f42eff63e4bc523d90b19a56a06e40ea86f6d8cf94e69b560e4464f2e7342bc2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads