755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
Size

6.1MB
MD5

fce75fff06900a89e764889f28c1025e
SHA1

13106b5ca292437d23634ccd0333a8e85f137279
SHA256

755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda
SHA512

eceb5161d1d3f431f510abdf3df91a76c83e398bbc2d1a7fc3b6a13d72955af0c1fefb57ceb267bde8907daee185706df575a277fe941f6b56a5182b5e7cda2a
SSDEEP

196608:C9MDvj7QH+Momd7Opx9jyma+m73nlXmcsU5:CcMH4UOpx9jymaV73n1T

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe

Drops file in System32 directory 2 IoCs

Processes:

755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe

description	ioc	process
File created	C:\Windows\SysWOW64\runouce.exe	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe

description	pid	process	target process
PID 2304 wrote to memory of 1196	2304	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
PID 2304 wrote to memory of 1196	2304	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
PID 2304 wrote to memory of 1196	2304	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
PID 2304 wrote to memory of 1196	2304	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
PID 2304 wrote to memory of 1256	2304	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe	Explorer.EXE
PID 2304 wrote to memory of 1256	2304	755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256

C:\Users\Admin\AppData\Local\Temp\755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
"C:\Users\Admin\AppData\Local\Temp\755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe"
2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2304

C:\Users\Admin\AppData\Local\Temp\755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe
"C:\Users\Admin\AppData\Local\Temp\755232f0de9bb5e9aca3971295aefa45adce5f82013cad656a51da1cd96ccfda.exe"
3⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-5-0x0000000000400000-0x0000000000A22000-memory.dmp

Filesize
6.1MB

Download
memory/1256-3-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/1256-2-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/2304-0-0x0000000000400000-0x0000000000A22000-memory.dmp

Filesize
6.1MB

Download
memory/2304-4-0x0000000002770000-0x0000000002D92000-memory.dmp

Filesize
6.1MB

Download
memory/2304-6-0x0000000000400000-0x0000000000A22000-memory.dmp

Filesize
6.1MB

Download