9e9b98a62ab64f57508d251739f8c626cbc3f39c3a1865c9e0b03f068530a6ed

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc824aa4024c51ce950d4c65dd9f2059.exe
Size

163KB
MD5

bc824aa4024c51ce950d4c65dd9f2059
SHA1

00b1f4d7aefadaf109c9b4782f7854c2d5913eb5
SHA256

9e9b98a62ab64f57508d251739f8c626cbc3f39c3a1865c9e0b03f068530a6ed
SHA512

ac0b6f755c30fcea40a45a9f169a411036d942fadcb0d521a75842ce4f8327f6f52e36def8062f2b8be3f4561ab04430f152ab8ac80d3d04f21bbc3da37d30ad
SSDEEP

3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/e8p:o68i3odBiTl2+TCU//

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart"	bc824aa4024c51ce950d4c65dd9f2059.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\bugMAKER.bat	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon10.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon12.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon13.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon14.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon5.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon7.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\winhash_up.exez	bc824aa4024c51ce950d4c65dd9f2059.exe
File opened for modification	C:\Windows\winhash_up.exez	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\winhash_up.exe	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon6.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon2.ico	bc824aa4024c51ce950d4c65dd9f2059.exe
File created	C:\Windows\SHARE_TEMP\Icon3.ico	bc824aa4024c51ce950d4c65dd9f2059.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2556	2956	bc824aa4024c51ce950d4c65dd9f2059.exe	28
PID 2956 wrote to memory of 2556	2956	bc824aa4024c51ce950d4c65dd9f2059.exe	28
PID 2956 wrote to memory of 2556	2956	bc824aa4024c51ce950d4c65dd9f2059.exe	28
PID 2956 wrote to memory of 2556	2956	bc824aa4024c51ce950d4c65dd9f2059.exe	28

C:\Users\Admin\AppData\Local\Temp\bc824aa4024c51ce950d4c65dd9f2059.exe
"C:\Users\Admin\AppData\Local\Temp\bc824aa4024c51ce950d4c65dd9f2059.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bugMAKER.bat
  2⤵
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\bugMAKER.bat

Filesize
76B

MD5
1eb3a3128946742b51548b74818504bf

SHA1
056ecaa09c6a4c97e5ec54db57d62e411fd99e86

SHA256
4455266f855f77bd295d7f8c8eed820ae18788f18bd65554f5cee58b93e02b65

SHA512
82c29df7798000716c514c6140e8a9fd29c2cbcd02959d6d3d94d9fd1a0bef9ad98217a5e963feda01de7f4d9af9327ab14e5034313148494c2c41fbc2358477

Download Submit
memory/2556-62-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/2956-67-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads