d02a35a91db8aa7e7d62ef72bad9719d4490f8f626c504c027347e8981ff20b9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe
Size

51KB
MD5

efc1462c7e7cec64c7c4415a055b7ffd
SHA1

85a6993f8d94df4ae64fcde7952324ca8fa0fa15
SHA256

0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab
SHA512

ef1dd04b2a1e01227159406cff69b785578d31e74d4a52d608eea539e846e726ba9255e7eba609aceb36e15dc19462765173df731a7002c0a1d6a25d5f219a89
SSDEEP

768:sk8QK8+NQdzo+YoSaGvx1F7+BXns5SDRWdo6IygHtWt5KN8VafEG6rp1D:ni80QVCV+BX2SdWOvPHktsNsEbgD

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zqdpdebj = "C:\\Users\\Admin\\AppData\\Roaming\\Zqdpdebj.exe"	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe
Token: SeDebugPrivilege	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe
Token: SeDebugPrivilege	2976	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84
PID 2984 wrote to memory of 2976	2984	0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe	84

C:\Users\Admin\AppData\Local\Temp\0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe
"C:\Users\Admin\AppData\Local\Temp\0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe
  "C:\Users\Admin\AppData\Local\Temp\0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0f76792935529fd3037fa201ae6b0d644f793972d3ce28bd4d473d1d56eeb8ab.exe.log

Filesize
1KB

MD5
f3eb81974dc5933681e933f07209ff5f

SHA1
7af8cae0f1d03e82daaf784df9886705685baac7

SHA256
e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

SHA512
d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

Download Submit
memory/2976-4902-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2976-4906-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2976-4905-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2976-4904-0x0000000004F50000-0x0000000005066000-memory.dmp

Filesize
1.1MB

Download
memory/2976-7244-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2976-7243-0x0000000005240000-0x00000000052DE000-memory.dmp

Filesize
632KB

Download
memory/2984-65-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-59-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-4-0x0000000007D10000-0x00000000082B4000-memory.dmp

Filesize
5.6MB

Download
memory/2984-5-0x0000000007860000-0x00000000078F2000-memory.dmp

Filesize
584KB

Download
memory/2984-7-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-15-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-25-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-23-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-21-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-19-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-17-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-13-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-11-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-9-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-6-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-35-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-41-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-57-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-63-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-2-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-69-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-67-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-61-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-3-0x0000000007470000-0x000000000775C000-memory.dmp

Filesize
2.9MB

Download
memory/2984-55-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-53-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-49-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-47-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-51-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-39-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-37-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-33-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-31-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-27-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-45-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-43-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-29-0x0000000007470000-0x0000000007756000-memory.dmp

Filesize
2.9MB

Download
memory/2984-4892-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-4893-0x0000000005900000-0x0000000005A28000-memory.dmp

Filesize
1.2MB

Download
memory/2984-4894-0x00000000057B0000-0x00000000057FC000-memory.dmp

Filesize
304KB

Download
memory/2984-1-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/2984-0-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/2984-4895-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/2984-4896-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2984-4897-0x0000000000A80000-0x0000000000AD4000-memory.dmp

Filesize
336KB

Download
memory/2984-4903-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads