ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2

Analysis

max time kernel
3s
max time network
8s
platform
windows7_x64
resource
win7v20201028
submitted
08-11-2020 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe
Size

50KB
MD5

745ded2f0c2c9b07ca67542af6bdd031
SHA1

43b9140d519c05bf0ff413d0bba1a90a03a132e2
SHA256

ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2
SHA512

f628aa8bc831e46291d7b76ae59ebd650fff694ecb0254ebd7a05452bbf2f32d5552775c981563f2de28396f341a5aac3cc73a5701a55f7ad8a849926b38df20

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2 = "c:\\windows\\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe -m"	ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

Processes:

ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

description	ioc	process
File created	\??\c:\windows\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe	ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe
File opened for modification	\??\c:\windows\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe	ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

pid process

1096 ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

pid process

1096 ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

pid	process
1096	ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

pid	process
1096	ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

C:\Users\Admin\AppData\Local\Temp\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe
"C:\Users\Admin\AppData\Local\Temp\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1096

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads