a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe
Size

36KB
MD5

861e76df11a983498cc0e71c07a49fdb
SHA1

dd82a3f6b4e1272a03361c319322c602a94e9a6a
SHA256

a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a
SHA512

25f9f62e5724757d4328a8f6a989569072ecefe9647706e28c370cdddd5f88f7eba7195102c0b8ffd660846b10787e62e915ae58397b813b92b8e7d4921a8439
SSDEEP

384:KrxUg1LUTHy4byzLeReRZn0uR9+hfORXtU8WedXw9vhsZ8MhtCBNeu9g:e7LUzQitu6hOTUfedg9ZOwLg

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\THREADORDER = "C:\\Users\\Admin\\AppData\\Local\\THREADORDER.exe"	regedit.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2564	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe
3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2564	3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe	30
PID 3024 wrote to memory of 2564	3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe	30
PID 3024 wrote to memory of 2564	3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe	30
PID 3024 wrote to memory of 2564	3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe	30
PID 3024 wrote to memory of 2564	3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe	30
PID 3024 wrote to memory of 2564	3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe	30
PID 3024 wrote to memory of 2564	3024	a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe	30

C:\Users\Admin\AppData\Local\Temp\a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe
"C:\Users\Admin\AppData\Local\Temp\a6b0b53ba2b9305dd0a9341495f357d7d87aaadf61a51130f9e7cefd42cc459a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\THREADORDER.exe

Filesize
36KB

MD5
6d46c6c79ef85ddc76db4b7d38a1c848

SHA1
f3f77667cd1ccc090cbfcc625812a6d24bbc34a3

SHA256
b7d0a2d89be12697d82aff08803fbd6578569060e46490871ef91ab14e7b3d69

SHA512
c30f7c051dbf405e477371c8373b0503c5efbb2d680569f1a9cd2f58c37ab56848797a04cd11a15d9f48514714c7c55b0878963b6f51c94a09ac5ce9ef59cb28

Download Submit
C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

Filesize
174B

MD5
fd27b675e9a1d698f77075e391f34b52

SHA1
178b5514679a863d08466184edfe8b468b1d435c

SHA256
9f2cd998ab65b5d6b8b4f94280a803cfb0cb9063d5c8286e437b03f7cf962047

SHA512
7d9445b3befc1dcd4ae4d7ef38b03ae3d7af0b6e3412081ec1b5d459e1e47a8aa352f996dfaed0b9d98d317d9bec62c0b3ceb4feaed3f16c0a85d97c495fb852

Download Submit
memory/3024-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3024-2-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/3024-1-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/3024-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads