7577262fc95eb1cd41448a817e9bf4cdf4c235ba5db83cb4992eb9b766ffb452

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe
Size

388KB
MD5

8b2aa0f8aa9886903d7550e94a92fffd
SHA1

0468ce60ce5e589e30b44783b266b1bf56f0f37a
SHA256

7577262fc95eb1cd41448a817e9bf4cdf4c235ba5db83cb4992eb9b766ffb452
SHA512

c4a0fc55478e2787596bd23c79b5b403e9e7182cab7220ec06938f46df4556368152933aeef9480ef3a3466b5d8c7fc9a5e58404603e114f4c098794cb48012f
SSDEEP

6144:KriwfRtCYQA2XFiFLL0E2XEiN0K3k9/pXEw8dHJhTdUB5jS+lDAA:e5tCllbXEyUi7dHJVdUB5NdAA

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe"	2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2072	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
916	2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3356	916	2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe	55
PID 916 wrote to memory of 3428	916	2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe	84
PID 916 wrote to memory of 3428	916	2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe	84
PID 3428 wrote to memory of 2072	3428	cmd.exe	86
PID 3428 wrote to memory of 2072	3428	cmd.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3356
- C:\Users\Admin\AppData\Local\Temp\2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c timeout /t 1 && DEL /f 2024-12-21_8b2aa0f8aa9886903d7550e94a92fffd_hiddentear.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-0-0x00007FFA3CEF3000-0x00007FFA3CEF5000-memory.dmp

Filesize
8KB

Download
memory/916-1-0x0000000000700000-0x0000000000766000-memory.dmp

Filesize
408KB

Download
memory/3356-2-0x0000000002340000-0x0000000002385000-memory.dmp

Filesize
276KB

Download
memory/3356-5-0x0000000002410000-0x000000000242C000-memory.dmp

Filesize
112KB

Download
memory/3356-4-0x00007FFA3E1F0000-0x00007FFA3E96A000-memory.dmp

Filesize
7.5MB

Download