5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba

Resubmissions

29-01-2022 15:13

220129-sl6rqscehj 10

Analysis

max time kernel
131s
max time network
143s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-01-2022 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe
Size

125KB
MD5

cedb0fc3dfbb748fdcbb3eae9eb0a3f1
SHA1

2bc0fba586148f69616239a1c939ddaff371bd14
SHA256

5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba
SHA512

dd514537e942f2fe647efc3a07b928a447b60248174bdfc00a9c28968d7f588f916e14f15ed7522f40870c192e4a63da5348e98742b36cdda22fea2bf72d697b

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\new_bApp = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\photoview.exe"	5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe

pid	Process
912	5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe

description	pid	Process
Token: SeDebugPrivilege	912	5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe

C:\Users\Admin\AppData\Local\Temp\5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe
"C:\Users\Admin\AppData\Local\Temp\5481af07cff7edf221b3c05bb24780e58b321595c40b776da4fb7cde4693dfba.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-115-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download