3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98

General

Target

3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe
Size

435KB
MD5

794a7bc49c07d085d9e3cd15515f961d
SHA1

ba3c257dc49a4fef8f59465b179b505db096fe33
SHA256

3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98
SHA512

6d56bbe23e395fa4839bc96e4632e6e98b2834b0a11fb34322c96f50a2b734f7a0d00f2c5b458766e389c739c3d5d03fec661038737ff6c340e3a7754a6b2f97
SSDEEP

6144:2/VRn8YJDOU6q7Fb3Y/Fuss5RMExwzXvgHRsE14miEHB9TTavJKvKCz3Pw51VLqj:UDRDOO3mixwz4HRWEHLTTFCCz34DVsz

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98 = "C:\\Users\\Admin\\AppData\\Roaming\\3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe"	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

8360 powershell.exe

pid	process
8360	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1964	3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe
Token: SeDebugPrivilege	8360	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe

description	pid	process	target process
PID 1964 wrote to memory of 8360	1964	3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe	powershell.exe
PID 1964 wrote to memory of 8360	1964	3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe	powershell.exe
PID 1964 wrote to memory of 8360	1964	3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe	powershell.exe
PID 1964 wrote to memory of 8360	1964	3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe
"C:\Users\Admin\AppData\Local\Temp\3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98' -Value '"C:\Users\Admin\AppData\Roaming\3ba0f4f8645247e4f440e38ca2b0f91bed5d239452e97054e75e25d371ec4d98.exe"' -PropertyType 'String'
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-39-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-3-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-2-0x00000000022F0000-0x00000000023CC000-memory.dmp

Filesize
880KB

Download
memory/1964-41-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-4-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-11-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-33-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-47-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-5-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-67-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-43-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-63-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/1964-59-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-57-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-55-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-53-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-51-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-49-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-45-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-65-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-1-0x00000000008E0000-0x0000000000954000-memory.dmp

Filesize
464KB

Download
memory/1964-61-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-37-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-35-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-31-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-29-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-27-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-25-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-23-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-21-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-19-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-17-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-15-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-13-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-9-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-7-0x00000000022F0000-0x00000000023C7000-memory.dmp

Filesize
860KB

Download
memory/1964-6278-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-6277-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/8360-6274-0x0000000070720000-0x0000000070CCB000-memory.dmp

Filesize
5.7MB

Download
memory/8360-6275-0x0000000070720000-0x0000000070CCB000-memory.dmp

Filesize
5.7MB

Download
memory/8360-6276-0x0000000070720000-0x0000000070CCB000-memory.dmp

Filesize
5.7MB

Download
memory/8360-6273-0x0000000070720000-0x0000000070CCB000-memory.dmp

Filesize
5.7MB

Download
memory/8360-6272-0x0000000070721000-0x0000000070722000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads