bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe
Size

410KB
MD5

37127fb6ebd2593a6af92fe28d308a06
SHA1

b570b64a5b1c30870cec478584ced71395bbef91
SHA256

bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b
SHA512

210d1dd6a1e04ae4fdb9e67c762624c23ef17145568b5b4c658de60ca43e3d2856cd33ea9a74b7aea49e1a1e91b37e2cda7af762b4770a5b579fc1cb79f456e5
SSDEEP

6144:6BxIK3CTW8TMjp41u6nyHwnZA9B8/H4QwRHLZ2L+az+bLdHGwbnLiMCfhepOD3nA:CxIK9V14ImyHY+B6HhCoDQ

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

pkcjry.exe

pid process

2528 pkcjry.exe

pid	process
2528	pkcjry.exe

Loads dropped DLL 2 IoCs

Processes:

bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe

pid	process
1548	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe
1548	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pkcjry.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\pkcjry.exe"	pkcjry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe

description	pid	process	target process
PID 1548 wrote to memory of 2528	1548	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe	pkcjry.exe
PID 1548 wrote to memory of 2528	1548	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe	pkcjry.exe
PID 1548 wrote to memory of 2528	1548	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe	pkcjry.exe
PID 1548 wrote to memory of 2528	1548	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe	pkcjry.exe

C:\Users\Admin\AppData\Local\Temp\bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe
"C:\Users\Admin\AppData\Local\Temp\bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548

C:\ProgramData\pkcjry.exe
"C:\ProgramData\pkcjry.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2528

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache .exe
Filesize
410KB

MD5
5ef3e3231c321bbbe34fa09f85167108

SHA1
8c44f9fe189518f6165e7e78b85d37da7e6a1b38

SHA256
ce19cafb6cb5f0a6a7e4440c9ac3b5133c831bafda8a683c5468cba93f87f4b7

SHA512
f3e4e330d68f220eef23678a9f4709c208610a7e07bc802a06fcf4be957aaca47efab4a157f3f2996844c3eb7655cdd8a6297ab87c349a0f1e9ac51db2416e8b

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
150KB

MD5
aef10b9ba25f907727558514f2dfbab0

SHA1
d67383ef1b23d4da72339d66de9541c2e1efaf53

SHA256
f5e77ddc706f6dffe056dc2f8a88adece36e0e4552bc70a85f36b1e01fe547ad

SHA512
5e607a70ca3fa489897f8df0c96570709839364cd8cabd5f76386dfff01ca2986d50c120cf82926dff950c7d7b6ec833ea7558b64ec8f0dfe2e5070abf1da103

Download Submit
\ProgramData\pkcjry.exe
Filesize
259KB

MD5
7b069b21a3fbd90b64c191c8cfb34185

SHA1
2a29adaf19c95048425cb74d34bb9afe63008f68

SHA256
1d4c4a206c14038c14b82bbe0a8f216490f093bafa772a5d1db31e316e0deec9

SHA512
9c12233993213091580b1dfe2f5cbda1218e352e513d163ab5653de3f0423ee1827e051e2a42003ae11cc8512510750513db2df4b48d1b9d8e41dc1478e544be

Download Submit
memory/1548-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1548-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1548-14-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/2528-102-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads