763ee735000712eeacd920a5b70da5d6ac1c1f176a5dda74ffcbd286cfc20664

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

val/Load Driver [ADMIN].bat
Size

38B
MD5

b56b9ab3209f7b0958976644f03776f8
SHA1

054c58ab6b517710776fa6ed8e20aabaf37d360f
SHA256

419124eb528c4c9ddb1e3713b72be124437f5632cf0ad1cbdc5b81c52407c401
SHA512

bf2515e032f3dd8885b4e8aead91dce3d46199d3dad242b8fee980b33a99def11def0f64936da7f3d456d4d376f0c3df68a4dca04b50f9cd314e99441a3d9f77

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LXDKtgHIvQyxG\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\LXDKtgHIvQyxG"	Mapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1788	Mapper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1788	Mapper.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1788	3500	cmd.exe	88
PID 3500 wrote to memory of 1788	3500	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\val\Load Driver [ADMIN].bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\val\Mapper.exe
  Mapper.exe Kernel.sys
  2⤵
  - Sets service image path in registry
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads