3edb4048164c839dc52eb7b03657626b48d38f30f92dabf44e873e11c9ba6e4d

Analysis

max time kernel
92s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Metamorph.exe
Size

679KB
MD5

1fca81b4c9dbee44c78b0b704a31046c
SHA1

b388ddf07e110d79ada6a365aadd028916e7a9a5
SHA256

3edb4048164c839dc52eb7b03657626b48d38f30f92dabf44e873e11c9ba6e4d
SHA512

50b00d9da3aa6dea2a2c03e3e3f77fc2e6e652f1627b6e339c9f7e0ae8088ee7aff14ed581fa32900533a93a9f3927171a3bf35becd2f5bfa95487afae65a79f
SSDEEP

12288:1bWTYdoIo0RMwBFSRuibPoIovlJTSp8WR4XF0xr:1bWTYpo0jFu5jCldy8WR4Kr

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KLPBdJwPTLNEqVH\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\KLPBdJwPTLNEqVH"	Metamorph.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5012	Metamorph.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5012	Metamorph.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 672	5012	Metamorph.exe	86
PID 5012 wrote to memory of 672	5012	Metamorph.exe	86

C:\Users\Admin\AppData\Local\Temp\Metamorph.exe
"C:\Users\Admin\AppData\Local\Temp\Metamorph.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads