b50bbb4b93fd8ef7a2876b3743dfda6945e9011f406e71b41897244b0b836467

Analysis

max time kernel
128s
max time network
140s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10-08-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe
Size

550KB
MD5

f004176cb0a58af018acc7b3ee4398af
SHA1

4fc9105afcbefcdfc0dbff01c5fc3ee8cc45ef75
SHA256

0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50
SHA512

42f73084adda1175edc7587ca119501b0040a42cd99418a16d57329d0c88b1a03e66c231d0fb8c5111d7104153d31040dd1ab47e3fc1ef9041b0a711e8354eb0
SSDEEP

6144:EPww4FehRKMT22sHO54gFbq1gXbMyxe8Z8ly1+QHGMY9JWaOKhlbA9NI9gZbCdpe:Ne5+8bYyxe8F1bHGPWaphL6Z+DQb

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyStartupApp = "C:\\ProgramData\\plugin\\pulg.exe"	reg.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4396	ipconfig.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1520	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	whoami.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2360	2404	0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe	74
PID 2404 wrote to memory of 2360	2404	0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe	74
PID 2360 wrote to memory of 3256	2360	cmd.exe	76
PID 2360 wrote to memory of 3256	2360	cmd.exe	76
PID 2360 wrote to memory of 4396	2360	cmd.exe	77
PID 2360 wrote to memory of 4396	2360	cmd.exe	77
PID 2404 wrote to memory of 1824	2404	0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe	78
PID 2404 wrote to memory of 1824	2404	0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe	78
PID 1824 wrote to memory of 1520	1824	cmd.exe	80
PID 1824 wrote to memory of 1520	1824	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe
"C:\Users\Admin\AppData\Local\Temp\0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C whoami && ipconfig
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- - C:\Windows\system32\ipconfig.exe
    ipconfig
    3⤵
    - Gathers network information
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyStartupApp /t REG_SZ /d C:\ProgramData\plugin\pulg.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyStartupApp /t REG_SZ /d C:\ProgramData\plugin\pulg.exe /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-0-0x0000027BC1D90000-0x0000027BC1D91000-memory.dmp

Filesize
4KB

Download
memory/2404-2-0x0000027BC3870000-0x0000027BC38F8000-memory.dmp

Filesize
544KB

Download
memory/2404-3-0x0000027BC3820000-0x0000027BC3869000-memory.dmp

Filesize
292KB

Download
memory/2404-4-0x0000027BC1DA0000-0x0000027BC1DA2000-memory.dmp

Filesize
8KB

Download
memory/2404-5-0x0000027BC3820000-0x0000027BC3869000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads