aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe
Size

410KB
MD5

cb8afa901f709e43154736a5c75b4d51
SHA1

c526715d221ae8986088d4427044e8e6a33b7706
SHA256

aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc
SHA512

fc1c1ab2484fc0ee0ae17ab16b92383ee2ffcba86f4147f13919fba483971a9ad24e2abfe1343259d481fc5d3077c1f11be526743e9c4106733f95e03a5cdf6b
SSDEEP

12288:CxIK9V14ImyHYnYPfCBjrWHFg92ROB82wh2:CJEyYnkC8cpdN

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2860	mqroy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\mqroy.exe"	mqroy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2860	4672	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe	87
PID 4672 wrote to memory of 2860	4672	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe	87
PID 4672 wrote to memory of 2860	4672	aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe	87

C:\Users\Admin\AppData\Local\Temp\aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe
"C:\Users\Admin\AppData\Local\Temp\aca1e5edffd286a3d4e0c66761072ed4bdfef3482d14769e2d8d43f8a9bef7dc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\ProgramData\mqroy.exe
  "C:\ProgramData\mqroy.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings .exe

Filesize
410KB

MD5
a1bddd879c7f540396203890f5af990e

SHA1
30d6e758ef7e2df5374017d58449a08b0cd690fa

SHA256
a1219697d820c5bd21eab404b1dd1b102db7ba7e21e04463577a0f346abda95f

SHA512
a7784ba0f297dc73dbcf2d4d41b9ac41877f2a46a4b8a456b1a8e8cd1c92baef7a548c7b83a45682e388f12232570599eb6df3fef07371a9a11e48d4304858f1

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
150KB

MD5
a52d6cb53c4c31e9f5ad53a356adf9dd

SHA1
4e9b2d208dc3c3a6e23decb0a7d7381c73f7b101

SHA256
f6bc441488529eadccfef115d11fa10c5cb8cb125b6c08c52a2bbc144bd4f7d8

SHA512
6d86153ffb8c803092d4fe30f1df1371657023eb10fd56dfeca684ff13a3222f64b11592576d3990f14cf915987a3372cf89774f811ef33dbd5f1b7db5ba681b

Download Submit
C:\ProgramData\mqroy.exe

Filesize
260KB

MD5
808560e272f5c765f2eb923301522cf0

SHA1
6005d34d3769359c46d0da935191739763c3308c

SHA256
ba04353759626fe546bdfcc7af2c96eac152a6886b59021443c87b7d7a857f80

SHA512
57525354d5a69a7435c418ad0f4fda415ba1e177e0f20acb90b05ad81247cfe07dcec1461863bab553b53fe9f7f595dbc7253496c50f5f521f81713938453f60

Download Submit
memory/2860-130-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4672-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4672-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4672-10-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads