ac6ff653497ef0da394e6485c2a29b584c602ae1fbed0a5327737e756045cc68

Analysis

max time kernel
148s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/07/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe
Size

258KB
MD5

7dd3e6ae26cab6c0b0e3a4c89d54aa7f
SHA1

e0d0a2764836786c7f0cee2d1fa5b30da73a5f61
SHA256

7b041cde211d98455249cf0d74b68be311b9d8a90cee098770075ad336a5b5c7
SHA512

94f6666b84b371d2f997cbc373f732092922b05ff5d93034beeef79fb07677ecb33343dbd34f4962d098d93a3857930fcb9bfd495f323d8f3d0fea9f0a378b98
SSDEEP

3072:ZLj/06/a80EfzCRVukTBLhTh3BOZOuCS1xiIvsXiS2gtyy7tQuua1WFx0v2vTH3K:Nj80a87fzzuPThb+PBpqtLx1+x0L

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	bitsserver.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	bitsserver.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	bitsserver.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	bitsserver.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	bitsserver.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2464 set thread context of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 3424 set thread context of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3272 set thread context of 4564	3272	bitsserver.exe	77
PID 3164 set thread context of 1416	3164	bitsserver.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bitsserver.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bitsserver.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bitsserver.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1416	bitsserver.exe
1416	bitsserver.exe
1416	bitsserver.exe
1416	bitsserver.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2496	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 2464 wrote to memory of 4664	2464	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	73
PID 4664 wrote to memory of 3424	4664	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	74
PID 4664 wrote to memory of 3424	4664	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	74
PID 4664 wrote to memory of 3424	4664	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	74
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3424 wrote to memory of 2496	3424	e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe	75
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 3272 wrote to memory of 4564	3272	bitsserver.exe	77
PID 4564 wrote to memory of 3164	4564	bitsserver.exe	78
PID 4564 wrote to memory of 3164	4564	bitsserver.exe	78
PID 4564 wrote to memory of 3164	4564	bitsserver.exe	78
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79
PID 3164 wrote to memory of 1416	3164	bitsserver.exe	79

C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe
"C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe
  "C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe
    "C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe
      "C:\Users\Admin\AppData\Local\Temp\e0d0a2764836786c7f0cee2d1fa5b30da73a5f61.exe"
      4⤵
      Suspicious behavior: RenamesItself
      PID:2496

C:\Windows\SysWOW64\bitsserver.exe
C:\Windows\SysWOW64\bitsserver.exe
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SysWOW64\bitsserver.exe
  C:\Windows\SysWOW64\bitsserver.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\bitsserver.exe
    "C:\Windows\SysWOW64\bitsserver.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Windows\SysWOW64\bitsserver.exe
      "C:\Windows\SysWOW64\bitsserver.exe"
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-4-0x0000000000700000-0x0000000000800000-memory.dmp

Filesize
1024KB

Download
memory/2496-11-0x0000000003000000-0x000000000304C000-memory.dmp

Filesize
304KB

Download
memory/2496-16-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3424-10-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/4664-1-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4664-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4664-3-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download