3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
16-08-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe
Size

102KB
MD5

771b8e84ba4f0215298d9dadfe5a10bf
SHA1

0f5e4c440cd2e7b7d97723424ba9c56339036151
SHA256

3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0
SHA512

2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164
SSDEEP

3072:pbqQQQQQQQQkQQQQQQQQQQQQQQ+QQQjQQQQQQQQQQQQQQxQQQQQQQQQjQQQQQQQ3:5qQQQQQQQQkQQQQQQQQQQQQQQ+QQQjQ+

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2608	winmsbt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Subsystem Framework = "\"C:\\ProgramData\\Microsoft Subsystem Framework\\winmsbt.exe\""	winmsbt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	pastebin.com
1	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe
Token: SeDebugPrivilege	2608	winmsbt.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2896	3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe
2608	winmsbt.exe
2608	winmsbt.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2896	3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe
2608	winmsbt.exe
2608	winmsbt.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2608	2896	3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe	82
PID 2896 wrote to memory of 2608	2896	3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe	82

C:\Users\Admin\AppData\Local\Temp\3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe
"C:\Users\Admin\AppData\Local\Temp\3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896
- C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe
  "C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe

Filesize
102KB

MD5
771b8e84ba4f0215298d9dadfe5a10bf

SHA1
0f5e4c440cd2e7b7d97723424ba9c56339036151

SHA256
3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0

SHA512
2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164

Download Submit
memory/2608-15-0x00007FFA978D0000-0x00007FFA98392000-memory.dmp

Filesize
10.8MB

Download
memory/2608-17-0x00007FFA978D0000-0x00007FFA98392000-memory.dmp

Filesize
10.8MB

Download
memory/2608-18-0x00007FFA978D0000-0x00007FFA98392000-memory.dmp

Filesize
10.8MB

Download
memory/2896-0-0x00007FFA978D3000-0x00007FFA978D5000-memory.dmp

Filesize
8KB

Download
memory/2896-1-0x0000000000C40000-0x0000000000C60000-memory.dmp

Filesize
128KB

Download
memory/2896-2-0x0000000002DD0000-0x0000000002DD6000-memory.dmp

Filesize
24KB

Download
memory/2896-14-0x00007FFA978D0000-0x00007FFA98392000-memory.dmp

Filesize
10.8MB

Download
memory/2896-16-0x00007FFA978D0000-0x00007FFA98392000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads