5611279aa9f8240e53ab0bf6de46a16505d2302a3ad11c356b6dc7f37b3d6428

Analysis

max time kernel
101s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.com_b1bca63354ee57a1519835f8e955d707.exe
Size 115KB
Sample240303-mxvkyshd7z
SHA256 5611279aa9f8240e53ab0bf6de46a16505d2302a3ad11c356b6dc7f37b3d6428
MD5 b1bca63354ee57a1519835f8e955d707
SHA1 fe2243fd88d1d9cd6e1a3aa041892d52bc275fa8
SHA512 f8f8cda4ea874208facdb24afeb94b7c9cc021f29b5ff974ed6b7d5634f7d4e00a1babb00e17df5cf79b5be0a6b236a2d47c039d9159400a89f4ab7984fe3797
SSDEEP 768:c1XfjCHM5KCI/LRPWO+ybg+wRla70FTZ/zHFoCytOMRzHqW:KXGs5KCgRuTagj53ytbRz7
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\8786919595519910	virussign.com_b1bca63354ee57a1519835f8e955d707.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\8786919595519910\stubpath = "C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\apple.exe"	virussign.com_b1bca63354ee57a1519835f8e955d707.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\apple.exe	virussign.com_b1bca63354ee57a1519835f8e955d707.exe
File opened for modification	C:\Program Files\Common Files\Apple\Mobile Device Support\apple.exe	virussign.com_b1bca63354ee57a1519835f8e955d707.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4836	4072	virussign.com_b1bca63354ee57a1519835f8e955d707.exe	90
PID 4072 wrote to memory of 4836	4072	virussign.com_b1bca63354ee57a1519835f8e955d707.exe	90
PID 4072 wrote to memory of 4836	4072	virussign.com_b1bca63354ee57a1519835f8e955d707.exe	90
PID 4072 wrote to memory of 2852	4072	virussign.com_b1bca63354ee57a1519835f8e955d707.exe	98
PID 4072 wrote to memory of 2852	4072	virussign.com_b1bca63354ee57a1519835f8e955d707.exe	98
PID 4072 wrote to memory of 2852	4072	virussign.com_b1bca63354ee57a1519835f8e955d707.exe	98

C:\Users\Admin\AppData\Local\Temp\virussign.com_b1bca63354ee57a1519835f8e955d707.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_b1bca63354ee57a1519835f8e955d707.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\8786919595519910" /f
  2⤵
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1.bat
  2⤵
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\1.bat
Size 133B
SHA256 f6f8cb90de84b0df7c974fca990933d7d02125e520986bd334564f61e0199260
MD5 c4ebe5015ca472231967632c2a6acba3
SHA1 51e55bbf13a5e07f8c858c3651f05c2988584b4e
SHA512 837368858ce3ec68a3e24b732f27fa7b519dd7070aa2b83cc04356eb654a090673e2b1bea3355fe7cbb5e646cd99883645224d524d0a040a6ac2ab28bc94f1b7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads