a703b317dc8a2e4f7955d9504865ad7537870bb294944afc668643603baf70ed

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c027e55b9a054379a5859837105dd0.exe
Size

13KB
MD5

d5c027e55b9a054379a5859837105dd0
SHA1

71698e9b27a20a67d32824e757f60f33dafecb4f
SHA256

a703b317dc8a2e4f7955d9504865ad7537870bb294944afc668643603baf70ed
SHA512

3af6b29d2517c52a338dc2ca08b358235017c447fe190a769efa49a64941f6c541d69a3a05b8a25ab61c6925b563b085f36dedf149f1d7d77b1c34c417c44d49
SSDEEP

384:xTsZocy8CY1iRzDK7BF5b3JFmqpTmfi2Kl8jV6M+:xwZoh8zazDK7BPldT6iSV+

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3440	ravdh3mon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ravdh3mon = "C:\\Program Files\\NetMeeting\\ravdh3mon.exe"	ravdh3mon.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\NetMeeting\ravdh3mon.cfg	d5c027e55b9a054379a5859837105dd0.exe
File opened for modification	C:\Program Files\NetMeeting\ravdh3mon.dat	ravdh3mon.exe
File created	C:\Program Files\NetMeeting\ravdh3mon.dat	ravdh3mon.exe
File opened for modification	C:\Program Files\NetMeeting\ravdh3mon.exe	d5c027e55b9a054379a5859837105dd0.exe
File created	C:\Program Files\NetMeeting\ravdh3mon.exe	d5c027e55b9a054379a5859837105dd0.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3436	d5c027e55b9a054379a5859837105dd0.exe
3436	d5c027e55b9a054379a5859837105dd0.exe
3436	d5c027e55b9a054379a5859837105dd0.exe
3436	d5c027e55b9a054379a5859837105dd0.exe
3440	ravdh3mon.exe
3440	ravdh3mon.exe
3440	ravdh3mon.exe
3440	ravdh3mon.exe
3440	ravdh3mon.exe
3440	ravdh3mon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	ravdh3mon.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3440	3436	d5c027e55b9a054379a5859837105dd0.exe	95
PID 3436 wrote to memory of 3440	3436	d5c027e55b9a054379a5859837105dd0.exe	95
PID 3436 wrote to memory of 3440	3436	d5c027e55b9a054379a5859837105dd0.exe	95
PID 3440 wrote to memory of 3408	3440	ravdh3mon.exe	56
PID 3436 wrote to memory of 1856	3436	d5c027e55b9a054379a5859837105dd0.exe	96
PID 3436 wrote to memory of 1856	3436	d5c027e55b9a054379a5859837105dd0.exe	96
PID 3436 wrote to memory of 1856	3436	d5c027e55b9a054379a5859837105dd0.exe	96

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408
- C:\Users\Admin\AppData\Local\Temp\d5c027e55b9a054379a5859837105dd0.exe
  "C:\Users\Admin\AppData\Local\Temp\d5c027e55b9a054379a5859837105dd0.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Program Files\NetMeeting\ravdh3mon.exe
    "C:\Program Files\NetMeeting\ravdh3mon.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\d5c027e55b9a054379a5859837105dd0.exe"
    3⤵
    PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\NetMeeting\ravdh3mon.exe

Filesize
13KB

MD5
d5c027e55b9a054379a5859837105dd0

SHA1
71698e9b27a20a67d32824e757f60f33dafecb4f

SHA256
a703b317dc8a2e4f7955d9504865ad7537870bb294944afc668643603baf70ed

SHA512
3af6b29d2517c52a338dc2ca08b358235017c447fe190a769efa49a64941f6c541d69a3a05b8a25ab61c6925b563b085f36dedf149f1d7d77b1c34c417c44d49

Download Submit