90cee64c0da47de7b66c5f50120051e3797f14c5609aea1c5e1aaf10e10537a8

Analysis

max time kernel
10s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

75KB
MD5

07202b2ac038a5853ee4fb88dcb9a899
SHA1

1cbe3734d3594cd2430e699e63972da458562dd3
SHA256

90cee64c0da47de7b66c5f50120051e3797f14c5609aea1c5e1aaf10e10537a8
SHA512

75c79157f14bb226ea3fedc011e79bfd57aed6a94f1a97c518755289da6bbcb9eeeeb327d45e70ed1e7d69e24a863f76ad0fc78dda593817b513c678de10c0c5
SSDEEP

1536:GOXQrSji6XN9+GVqQ7zgN9ebqvjoJExemwHX9TM:GOXQA+QqQfgNY0emcQ

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\Win32.exe"	reg.exe

Drops file in Windows directory 2 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Win32.exe cmd.exe
File opened for modification C:\Windows\Win32.exe cmd.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3316 taskkill.exe
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

8 reg.exe
4028 reg.exe
4652 reg.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 3316 taskkill.exe

description	ioc	process
File created	C:\Windows\Win32.exe	cmd.exe
File opened for modification	C:\Windows\Win32.exe	cmd.exe

pid	process
3316	taskkill.exe

pid	process
8	reg.exe
4028	reg.exe
4652	reg.exe

description	pid	process
Token: SeDebugPrivilege	3316	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

test.execmd.exe

description	pid	process	target process
PID 3300 wrote to memory of 1796	3300	test.exe	cmd.exe
PID 3300 wrote to memory of 1796	3300	test.exe	cmd.exe
PID 1796 wrote to memory of 3316	1796	cmd.exe	taskkill.exe
PID 1796 wrote to memory of 3316	1796	cmd.exe	taskkill.exe
PID 1796 wrote to memory of 8	1796	cmd.exe	reg.exe
PID 1796 wrote to memory of 8	1796	cmd.exe	reg.exe
PID 1796 wrote to memory of 4652	1796	cmd.exe	reg.exe
PID 1796 wrote to memory of 4652	1796	cmd.exe	reg.exe
PID 1796 wrote to memory of 4028	1796	cmd.exe	reg.exe
PID 1796 wrote to memory of 4028	1796	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\64B5.tmp\test.bat" "C:\Users\Admin\AppData\Local\Temp\test.exe""
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\system32\taskkill.exe
taskkill /im explorer.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\reg.exe
Reg Delete HKLM\System\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:8

C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Win32 /t REG_SZ /d C:\Windows\Win32.exe /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:4652

C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:4028

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\64B5.tmp\test.bat
Filesize
1KB

MD5
3423bfcd5d796f351d6877277656dce0

SHA1
fd97b809225bd6410667ef6186b9b65632566a99

SHA256
83a6299c3d4dcb0a864de86be96059106125204e949098d4c718f5312496b47c

SHA512
8af1c2c263d6385beda9e213988447dd1b79223ee286fec849d067fa0d4950af8cfafdf47812c59723558f1f28b693e077edc61308c9859d33f9e2838c4ddde6

Download Submit