69b71a7d045a84ebf362385e256e5b23e2eae6135081b2aafcf783854a0f50b9

Analysis

max time kernel
22s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3dcbfe17278f06298c64b5e0f616ec3.exe
Size

634KB
MD5

d3dcbfe17278f06298c64b5e0f616ec3
SHA1

be3b2c3747e746f2b6cbcd0ddf4da0ff38499cab
SHA256

69b71a7d045a84ebf362385e256e5b23e2eae6135081b2aafcf783854a0f50b9
SHA512

dc68149d7a03e24ee6c9fcec9adb6efa9df63e235ca826740598e43d328e1a93aa643bc0bf20937c3817deb52f23dc7d19389d3c02fdb777bbc0ae17ca8806de
SSDEEP

6144:IooZIFH5nlz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1I:ISF1l1gL5pRTcAkS/3hzN8qE43fm78Vc

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2296	MSWDM.EXE
1060	MSWDM.EXE
2892	D3DCBFE17278F06298C64B5E0F616EC3.EXE
1364	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	d3dcbfe17278f06298c64b5e0f616ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	d3dcbfe17278f06298c64b5e0f616ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	d3dcbfe17278f06298c64b5e0f616ec3.exe
File opened for modification	C:\Windows\dev4045.tmp	d3dcbfe17278f06298c64b5e0f616ec3.exe
File opened for modification	C:\Windows\dev4045.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	MSWDM.EXE
1060	MSWDM.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2296	1872	d3dcbfe17278f06298c64b5e0f616ec3.exe	83
PID 1872 wrote to memory of 2296	1872	d3dcbfe17278f06298c64b5e0f616ec3.exe	83
PID 1872 wrote to memory of 2296	1872	d3dcbfe17278f06298c64b5e0f616ec3.exe	83
PID 1872 wrote to memory of 1060	1872	d3dcbfe17278f06298c64b5e0f616ec3.exe	84
PID 1872 wrote to memory of 1060	1872	d3dcbfe17278f06298c64b5e0f616ec3.exe	84
PID 1872 wrote to memory of 1060	1872	d3dcbfe17278f06298c64b5e0f616ec3.exe	84
PID 1060 wrote to memory of 2892	1060	MSWDM.EXE	85
PID 1060 wrote to memory of 2892	1060	MSWDM.EXE	85
PID 1060 wrote to memory of 1364	1060	MSWDM.EXE	87
PID 1060 wrote to memory of 1364	1060	MSWDM.EXE	87
PID 1060 wrote to memory of 1364	1060	MSWDM.EXE	87

C:\Users\Admin\AppData\Local\Temp\d3dcbfe17278f06298c64b5e0f616ec3.exe
"C:\Users\Admin\AppData\Local\Temp\d3dcbfe17278f06298c64b5e0f616ec3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1872
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2296
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4045.tmp!C:\Users\Admin\AppData\Local\Temp\d3dcbfe17278f06298c64b5e0f616ec3.exe! !
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\D3DCBFE17278F06298C64B5E0F616EC3.EXE
    3⤵
    - Executes dropped EXE
    PID:2892
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4045.tmp!C:\Users\Admin\AppData\Local\Temp\D3DCBFE17278F06298C64B5E0F616EC3.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D3DCBFE17278F06298C64B5E0F616EC3.EXE

Filesize
634KB

MD5
6cfd65c3a4e63a2ec96ab61453462986

SHA1
59370bd3d2e8f8ba16c395e390ba1f46ec1b994e

SHA256
da09410b5631325f918017cdd6ad5adb4486efb0816b1a3710ffe8a66fcb2556

SHA512
5a2e848e6360280d0b6707dd83322e2be73b531fbde76fdf0f6913bb9c2f3d1cb41c0f661058952b7f668ce7b1f427246133543a7c107fdb0694403f73f1fcb1

Download Submit
C:\Windows\MSWDM.EXE

Filesize
176KB

MD5
8a351d3a4fdac918dccdbcb21c60b59c

SHA1
bdf5b7d41c4d62fbb23f71e9d7f7a4b9d7c4815a

SHA256
7c5d7b0369ef97f79d2a0492f2fc9f1e784f3f3317bd375c03bf0bf071673c95

SHA512
761a6aa05f6cf9892b839069eb298a5d3eec0e2e9dc0b287f05c38c984c388b7ce1e4adf9f371afabf342b3b38ba8814492eab3da2421597589f88ff338f2d2a

Download Submit
C:\Windows\dev4045.tmp

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
memory/1060-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1060-20-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1364-18-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1872-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1872-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2296-21-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download