70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe
Size

978KB
MD5

6d9f3a386490c69c6d6a49a5d1b756a5
SHA1

7c49c3a73e94674c803381cfd199e4f6bd9c7d60
SHA256

70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419
SHA512

2310deb2d92b94321fa4dd0aebe0c91bf93cb3915c74d6a3ee6b42bf7fa2846ba0f9e0cb70e60924fbcd073244c85e20bf9058c159cfd7a675f9481f59dd935a
SSDEEP

24576:HZGtMXDHVI7ZsW2oXWWIAi0+NDP+k1HkT6vN72rgJ/n:HQc1QuW2gd+ddlN2cJv

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bsmpeu = "C:\\Users\\Admin\\AppData\\Roaming\\Bsmpeu.exe"	70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2136	70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe
Token: SeDebugPrivilege	2136	70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 4200	2136	70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe	30
PID 2136 wrote to memory of 4200	2136	70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe	30
PID 2136 wrote to memory of 4200	2136	70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe	30

C:\Users\Admin\AppData\Local\Temp\70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe
"C:\Users\Admin\AppData\Local\Temp\70a9729398a4acd0bbeb8a75eb62555cd8f509f3ac4e04338c62cdef3a8d0419.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 620
  2⤵
  PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-0-0x000007FEF5F73000-0x000007FEF5F74000-memory.dmp

Filesize
4KB

Download
memory/2136-1-0x0000000001050000-0x000000000114A000-memory.dmp

Filesize
1000KB

Download
memory/2136-2-0x0000000000E10000-0x0000000000EF0000-memory.dmp

Filesize
896KB

Download
memory/2136-3-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-4-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-6-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-14-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-26-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-28-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-48-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-58-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-60-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-9-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-66-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-64-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-62-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-56-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-54-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-52-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-50-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-46-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-44-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-42-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-40-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-38-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-36-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-34-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-32-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-30-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-24-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-22-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-20-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-18-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-16-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-10-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-12-0x0000000000E10000-0x0000000000EE9000-memory.dmp

Filesize
868KB

Download
memory/2136-1077-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-1078-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-1079-0x00000000006F0000-0x000000000074A000-memory.dmp

Filesize
360KB

Download
memory/2136-1080-0x0000000000860000-0x00000000008AC000-memory.dmp

Filesize
304KB

Download
memory/2136-1082-0x00000000008B0000-0x0000000000904000-memory.dmp

Filesize
336KB

Download
memory/2136-1083-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-1085-0x000007FEF5F73000-0x000007FEF5F74000-memory.dmp

Filesize
4KB

Download
memory/2136-1086-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download