5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3c53eb5851703358e2bfacec3b19aa4.exe
Size 16KB
Sample240319-e9yt5shf82
SHA256 5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7
MD5 b3c53eb5851703358e2bfacec3b19aa4
SHA1 8cf5d03b5522e2f24187f04c0d3ab556fe3d1686
SHA512 7fc70fc6a99f2dc00eb5c9acdacde40d1b4c3a4d4395b47bf637f3de6c8468f837c023a327feb3b03ce91a73a168132d481897511c78bd0f8a28dd4cf300bc16
SSDEEP 384:26kyHLpL3LxYLTLc8VcpOjAM+o/8E9VF0NyFbm:26XHFz1YnwscpOjAMxkEK
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RtkAudUApp64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b3c53eb5851703358e2bfacec3b19aa4.exe"	b3c53eb5851703358e2bfacec3b19aa4.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1928	powershell.exe
1928	powershell.exe
4640	powershell.exe
4640	powershell.exe
4516	powershell.exe
4516	powershell.exe
3380	powershell.exe
3380	powershell.exe
448	powershell.exe
448	powershell.exe
3700	powershell.exe
3700	powershell.exe
1488	powershell.exe
1488	powershell.exe
1408	powershell.exe
1408	powershell.exe
4640	powershell.exe
4516	powershell.exe
1928	powershell.exe
448	powershell.exe
3380	powershell.exe
3700	powershell.exe
1408	powershell.exe
1488	powershell.exe
4276	powershell.exe
4276	powershell.exe
3888	powershell.exe
3888	powershell.exe
2404	powershell.exe
2404	powershell.exe
1560	powershell.exe
1560	powershell.exe
1580	powershell.exe
1580	powershell.exe
4560	powershell.exe
4560	powershell.exe
1248	powershell.exe
1248	powershell.exe
4080	powershell.exe
4080	powershell.exe
3888	powershell.exe
4276	powershell.exe
1560	powershell.exe
2404	powershell.exe
1580	powershell.exe
4560	powershell.exe
1248	powershell.exe
4080	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	b3c53eb5851703358e2bfacec3b19aa4.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1488	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	88
PID 2708 wrote to memory of 1488	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	88
PID 2708 wrote to memory of 1408	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	89
PID 2708 wrote to memory of 1408	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	89
PID 2708 wrote to memory of 448	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	90
PID 2708 wrote to memory of 448	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	90
PID 2708 wrote to memory of 4516	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	91
PID 2708 wrote to memory of 4516	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	91
PID 2708 wrote to memory of 4640	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	92
PID 2708 wrote to memory of 4640	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	92
PID 2708 wrote to memory of 1928	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	93
PID 2708 wrote to memory of 1928	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	93
PID 2708 wrote to memory of 3700	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	94
PID 2708 wrote to memory of 3700	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	94
PID 2708 wrote to memory of 3380	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	95
PID 2708 wrote to memory of 3380	2708	b3c53eb5851703358e2bfacec3b19aa4.exe	95
PID 3700 wrote to memory of 4276	3700	powershell.exe	104
PID 3700 wrote to memory of 4276	3700	powershell.exe	104
PID 4516 wrote to memory of 1560	4516	powershell.exe	105
PID 4516 wrote to memory of 1560	4516	powershell.exe	105
PID 448 wrote to memory of 2404	448	powershell.exe	106
PID 448 wrote to memory of 2404	448	powershell.exe	106
PID 4640 wrote to memory of 3888	4640	powershell.exe	107
PID 4640 wrote to memory of 3888	4640	powershell.exe	107
PID 3380 wrote to memory of 1248	3380	powershell.exe	108
PID 3380 wrote to memory of 1248	3380	powershell.exe	108
PID 1408 wrote to memory of 1580	1408	powershell.exe	109
PID 1408 wrote to memory of 1580	1408	powershell.exe	109
PID 1488 wrote to memory of 4560	1488	powershell.exe	110
PID 1488 wrote to memory of 4560	1488	powershell.exe	110
PID 1928 wrote to memory of 4080	1928	powershell.exe	111
PID 1928 wrote to memory of 4080	1928	powershell.exe	111

C:\Users\Admin\AppData\Local\Temp\b3c53eb5851703358e2bfacec3b19aa4.exe
"C:\Users\Admin\AppData\Local\Temp\b3c53eb5851703358e2bfacec3b19aa4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Control.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Anyns.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Header.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Taskhost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess Microsoft.ServiceHub.Runtime.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ProgramData\Microsoft\Diagnosis\Sideload\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...