92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

582KB
MD5

ce1054d542dbd999401236f2ce20f826
SHA1

df07ed235ee93f44f4f0e4dd73f0e8af068a7791
SHA256

81716b54cb34ef6d6938c042e30c847742dcffeb8ed4e67268387fed040b9315
SHA512

efe21b9393084e098b9e3baafcd7467e25d764b70a8f34d071de9c4f3e8f1ead3974c9fe3d98152eb16dbd17e7f6bed985939d6b305441cec4ac548284c9716b
SSDEEP

12288:x1ziebuYdvx24mGeamdda+W2JyaslYC1JL9PcSCfB:x1mohzmHamuCJyasaCVP6fB

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

FileCoAuth.exe

pid process

3036 FileCoAuth.exe

Loads dropped DLL 9 IoCs

Processes:

FileCoAuth.exe

pid	process
3036	FileCoAuth.exe
3036	FileCoAuth.exe
3036	FileCoAuth.exe
3036	FileCoAuth.exe
3036	FileCoAuth.exe
3036	FileCoAuth.exe
3036	FileCoAuth.exe
3036	FileCoAuth.exe
3036	FileCoAuth.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

FileCoAuth.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Image Photo Viewer = "C:\\users\\Admin\\appdata\\local\\Microsoft\\PlayReady\\FileCoAuth.exe"	FileCoAuth.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 1840 wrote to memory of 3036	1840	Setup.exe	FileCoAuth.exe
PID 1840 wrote to memory of 3036	1840	Setup.exe	FileCoAuth.exe
PID 1840 wrote to memory of 3036	1840	Setup.exe	FileCoAuth.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1840

C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe
"C:\users\Admin\appdata\local\Microsoft\PlayReady\FileCoAuth.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\PlayReady\FileCoAuth.exe
Filesize
582KB

MD5
ce1054d542dbd999401236f2ce20f826

SHA1
df07ed235ee93f44f4f0e4dd73f0e8af068a7791

SHA256
81716b54cb34ef6d6938c042e30c847742dcffeb8ed4e67268387fed040b9315

SHA512
efe21b9393084e098b9e3baafcd7467e25d764b70a8f34d071de9c4f3e8f1ead3974c9fe3d98152eb16dbd17e7f6bed985939d6b305441cec4ac548284c9716b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\PlayReady\LoggingPlatform.dll
Filesize
450KB

MD5
b54858b7357303dbd5582ea44abeeab8

SHA1
f3ba1d65f855d61dce13efbc42ce60ca8548a49c

SHA256
cc912e37802cd5c128c19949d4529e7d48266d67dd7b6dfedfd9c493d94cbe64

SHA512
b364ee1019e215c10030834cca4ca6436568e6ef25d2bee877b908bbf68f7c004559ff5317275b17c2f221c0daedbf50e11ec1bfe29c96cb61389cba75bb2295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\PlayReady\UpdateRingSettings.dll
Filesize
377KB

MD5
9f950504d5ea22c6f1ee20f7c2ed3b7b

SHA1
5090de783322847e6395567e7449fc4200b054a5

SHA256
37253093d3c8ed1d56b3a50f31f8944888ff38b714097637c5372a0ad19c337b

SHA512
ae80c7778304140d4476d42f6ef4439c61c2ec4ff42958007b93418a53908fb516544c57e1db99b7a6d79ae501f49c46f6636d8f967b033e744feb33879e0734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\PlayReady\vcruntime140.dll
Filesize
77KB

MD5
f686e2331a83d20798cfc2734729e531

SHA1
c7e6398f5a735039baabf22712c5a8aee5a945e1

SHA256
535f74f446a1b7b53da24a742d02369cbcc609003a6b4a8175491aa71c5481b4

SHA512
30ea339ec845dbc9aa7b323ed25e516cb04f3e17789cd28f54646c82395f0b42eb4a5d4d4aa06c4d39b9602c37590b31ca5c0bfa22a514a73ec45e39c0d8e31a

Download Submit
C:\users\Admin\appdata\local\Microsoft\PlayReady\MSVCP140.dll
Filesize
438KB

MD5
a1b3963e1766c5266d94b171a4595cee

SHA1
9283a813774f2e310997ba08bca9ec96282a85d1

SHA256
0f5aeae55bf6d7b37e5582ec60bbdb93bf24adf648f9fa342cdba1b0a754e403

SHA512
ef0a3cb33902eb0dd3d80b688f5e23b4192ebafb131b30c56f27221412daf72b40c3e17670ec1ca8209775369f93bf66a3a75ae5acff45e629e732464d3972b8

Download Submit
C:\users\Admin\appdata\local\Microsoft\PlayReady\WTSAPI32.dll
Filesize
267KB

MD5
75d2c686d410ec1f880a6fd7a9800055

SHA1
c5fa1dc0a76bed67f1a1a9bc943b39ef6e4ed104

SHA256
8e2429d70989bbdd2ea8842dce7c3d790ebe148490ee519b47767557f4a4a733

SHA512
a05115d2eaed22ac685b0e45751650bd58f6d4f46c6fb2ba8fb564b1a959ea27ac209e1d1c53e4c966ee8d0e502af7ab9e3ccb311b66d704160141b12edac2c5

Download Submit