4d6c6e692ed858751fcf355c55976d2f995a7bd3fa389669cd668d193af517b6

Analysis

max time kernel
4s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad8e0e06a6c2dd814a2c13afd46bc038.exe
Size

30KB
MD5

ad8e0e06a6c2dd814a2c13afd46bc038
SHA1

a799c90d1cd73caecf9f6486c8d08fb4bf2b03e1
SHA256

4d6c6e692ed858751fcf355c55976d2f995a7bd3fa389669cd668d193af517b6
SHA512

9c2cb3993e90ef6b1f83dbac963ba10e60002ac528261e57dbcc884ff5a06289f54859bde8b407fa50a3397eb4bd675b32e6d6231f6af01c036133f0231bdc52
SSDEEP

768:VGkIOT8HdPYv191waPo5QGN4PBWiOxZM6e:wNHFsaNsIiMe

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
432	ad8e0e06a6c2dd814a2c13afd46bc038.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mppds = "C:\\Windows\\mppds.exe"	ad8e0e06a6c2dd814a2c13afd46bc038.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mppds.dll	ad8e0e06a6c2dd814a2c13afd46bc038.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\mppds.exe	ad8e0e06a6c2dd814a2c13afd46bc038.exe
File opened for modification	C:\Windows\mppds.exe	ad8e0e06a6c2dd814a2c13afd46bc038.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	ad8e0e06a6c2dd814a2c13afd46bc038.exe
432	ad8e0e06a6c2dd814a2c13afd46bc038.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	ad8e0e06a6c2dd814a2c13afd46bc038.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 3408	432	ad8e0e06a6c2dd814a2c13afd46bc038.exe	55
PID 432 wrote to memory of 3408	432	ad8e0e06a6c2dd814a2c13afd46bc038.exe	55

C:\Users\Admin\AppData\Local\Temp\ad8e0e06a6c2dd814a2c13afd46bc038.exe
"C:\Users\Admin\AppData\Local\Temp\ad8e0e06a6c2dd814a2c13afd46bc038.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mppds.dll

Filesize
23KB

MD5
6fba311f9433153bfd46aa21d0a46eb4

SHA1
95874a42d2d0f34ee7cfa1c8618c4beefdea2db7

SHA256
b7fa166b664ef26156047788e838e96783c647a42a2a740fff5c733d41666de8

SHA512
bcd6e5d143239ea3319ab38d4242b2383ff203fadca0fbf661d2c23cd03bde94e9665dcff2fbf39482a66a16b2f3f40ab684bad1ba203881f71d8b829fef8582

Download Submit
memory/432-5-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download