c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2

General

Target

c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Size

221KB
MD5

be851b65202e55ca4b0c6cbf4262da22
SHA1

1510cd0af47941a1a8b5c195bbcd43f5df0709be
SHA256

c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2
SHA512

c72b31e7b8a61a2d85b125922309320e868ce2b2227886e3c885518670aec86d2af5c84ee0cf68060f47f2a1cc9244aba245ced739d6e8df9da7d61dcfb5622a

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe"	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

pid process

1996 c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

pid process

1996 c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

pid	process
1996	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
1996	c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe

C:\Users\Admin\AppData\Local\Temp\c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe
"C:\Users\Admin\AppData\Local\Temp\c3241668b492fb19d3f65dfef1465a93c738ad46cae9581e578a563047681ab2.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads