Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    15-05-2021 12:52

General

  • Target

    7312cd2724a53e4af84ca60e1da575434ddd6f0b8ad4477f2da38f0e9c5eab0d.exe

  • Size

    318KB

  • MD5

    bbe3a778df4dcf19673c59aab55a8b0d

  • SHA1

    c9ee96ea5ff173d651d6cd518efd1475e83e8baa

  • SHA256

    7312cd2724a53e4af84ca60e1da575434ddd6f0b8ad4477f2da38f0e9c5eab0d

  • SHA512

    df756e4aa50dca6cad76ea9cfa8de726bb52b99f04abc206011148f76de2541b97a7924b2d2e1b1338120d28c34cf345da15ad3e2377b9c42b88a32912173970

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7312cd2724a53e4af84ca60e1da575434ddd6f0b8ad4477f2da38f0e9c5eab0d.exe
    "C:\Users\Admin\AppData\Local\Temp\7312cd2724a53e4af84ca60e1da575434ddd6f0b8ad4477f2da38f0e9c5eab0d.exe"
    1⤵
    • Adds policy Run key to start application
    • Adds Run key to start application
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:624

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

2
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/624-114-0x0000000000400000-0x0000000000434000-memory.dmp
    Filesize

    208KB