7b3d2b4b4d3415d9865c0d6fb877ec0b9cf102bcb18a19f906050b981a5f02a4

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96e8608846f13159c90ad7bdcde44934.exe
Size

372KB
MD5

96e8608846f13159c90ad7bdcde44934
SHA1

553012b135f50a1a8556a7157b5fcac2cc5eb260
SHA256

7b3d2b4b4d3415d9865c0d6fb877ec0b9cf102bcb18a19f906050b981a5f02a4
SHA512

087098aba9ce7006f221949ff7b167cc09108ac21bf84e48a2f900dec4c8c5799202dbc07463cae5046671a5fffc2c80ce24c95e5b4f4f0418d350a69405e91b
SSDEEP

6144:Od6HSfevOW+zIgfYsqsUvhDWg9yhuGgfnQJDZ7qDGQsbesEMCcrP:rHSfevmTxWhDWgFQ/GGfEMCcr

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1My = "C:\\Users\\Admin\\AppData\\Roaming\\rss.exe"	96e8608846f13159c90ad7bdcde44934.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1572	3572	96e8608846f13159c90ad7bdcde44934.exe	85
PID 3572 wrote to memory of 1572	3572	96e8608846f13159c90ad7bdcde44934.exe	85

C:\Users\Admin\AppData\Local\Temp\96e8608846f13159c90ad7bdcde44934.exe
"C:\Users\Admin\AppData\Local\Temp\96e8608846f13159c90ad7bdcde44934.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SYSTEM32\winlogon.exe
  winlogon
  2⤵
  PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3572-0-0x000000001B710000-0x000000001B7B6000-memory.dmp

Filesize
664KB

Download
memory/3572-1-0x00007FF91F6A0000-0x00007FF920041000-memory.dmp

Filesize
9.6MB

Download
memory/3572-2-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/3572-3-0x00007FF91F6A0000-0x00007FF920041000-memory.dmp

Filesize
9.6MB

Download
memory/3572-4-0x000000001BC90000-0x000000001C15E000-memory.dmp

Filesize
4.8MB

Download
memory/3572-5-0x000000001C270000-0x000000001C30C000-memory.dmp

Filesize
624KB

Download
memory/3572-6-0x00000000012D0000-0x00000000012D8000-memory.dmp

Filesize
32KB

Download
memory/3572-7-0x000000001C520000-0x000000001C56C000-memory.dmp

Filesize
304KB

Download
memory/3572-8-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/3572-15-0x00007FF91F6A0000-0x00007FF920041000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads