774a06ee0917bab638b98728742962cc11d409d5fc4f6ed5194a9c64a5f2cc2d

Analysis

max time kernel
138s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

register.exe
Size

35KB
MD5

1d95755ffcfc57da3b9c32ff5fdb6934
SHA1

c8a33a7b3394c1b4a0ba04d68b07579d711274b3
SHA256

94779bc3bd7e5a2a284a4839bd3b7a18bb59527d88b1d57b0f547eae67360fcc
SHA512

6d17f5a263699b683232f5f6b3c769a88e7c917e55bfbd89d0b847259340ff86d7e0ba36f3dac27c56a01ea4015b80607bc04b22de4b19aa1dde8af895a1324a
SSDEEP

768:FHaBX1ovfDMSA3yVG0nkrA/W7w2hyXV2tCIa6syM:UM3DMSzVvnkrA/2hyXQAB

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	Explorer.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	85.255.112.110
Destination IP	85.255.116.69
Destination IP	85.255.112.110
Destination IP	85.255.116.69

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ajsck.exe	register.exe
File opened for modification	C:\Windows\SysWOW64\ajsck.exe	register.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 1396	1368	register.exe	28
PID 1368 set thread context of 2744	1368	register.exe	29

Gathers network information 2 TTPs 5 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2548	ipconfig.exe
2504	ipconfig.exe
2592	ipconfig.exe
2616	ipconfig.exe
2668	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1368	register.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1396	1368	register.exe	28
PID 1368 wrote to memory of 1396	1368	register.exe	28
PID 1368 wrote to memory of 1396	1368	register.exe	28
PID 1368 wrote to memory of 1396	1368	register.exe	28
PID 1368 wrote to memory of 1396	1368	register.exe	28
PID 1368 wrote to memory of 2744	1368	register.exe	29
PID 1368 wrote to memory of 2744	1368	register.exe	29
PID 1368 wrote to memory of 2744	1368	register.exe	29
PID 1368 wrote to memory of 2744	1368	register.exe	29
PID 1368 wrote to memory of 2744	1368	register.exe	29
PID 1396 wrote to memory of 2616	1396	iexplore.exe	30
PID 1396 wrote to memory of 2616	1396	iexplore.exe	30
PID 1396 wrote to memory of 2616	1396	iexplore.exe	30
PID 1396 wrote to memory of 2616	1396	iexplore.exe	30
PID 1396 wrote to memory of 2668	1396	iexplore.exe	32
PID 1396 wrote to memory of 2668	1396	iexplore.exe	32
PID 1396 wrote to memory of 2668	1396	iexplore.exe	32
PID 1396 wrote to memory of 2668	1396	iexplore.exe	32
PID 1396 wrote to memory of 2548	1396	iexplore.exe	33
PID 1396 wrote to memory of 2548	1396	iexplore.exe	33
PID 1396 wrote to memory of 2548	1396	iexplore.exe	33
PID 1396 wrote to memory of 2548	1396	iexplore.exe	33
PID 1396 wrote to memory of 2504	1396	iexplore.exe	35
PID 1396 wrote to memory of 2504	1396	iexplore.exe	35
PID 1396 wrote to memory of 2504	1396	iexplore.exe	35
PID 1396 wrote to memory of 2504	1396	iexplore.exe	35
PID 1396 wrote to memory of 2592	1396	iexplore.exe	36
PID 1396 wrote to memory of 2592	1396	iexplore.exe	36
PID 1396 wrote to memory of 2592	1396	iexplore.exe	36
PID 1396 wrote to memory of 2592	1396	iexplore.exe	36

C:\Users\Admin\AppData\Local\Temp\register.exe
"C:\Users\Admin\AppData\Local\Temp\register.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:2616
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /registerdns
    3⤵
    - Gathers network information
    PID:2668
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /dnsflush
    3⤵
    - Gathers network information
    PID:2548
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /renew
    3⤵
    - Gathers network information
    PID:2504
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /renew_all
    3⤵
    - Gathers network information
    PID:2592
- C:\Windows\SysWOW64\Explorer.exe
  Explorer.exe
  2⤵
  - Deletes itself
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1368-6-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download