9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40

Analysis

max time kernel
160s
max time network
186s
platform
windows10_x64
resource
win10-en-20211208
submitted
29-01-2022 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe
Size

87KB
MD5

9e73d275202b02b3f0ed23951fda30da
SHA1

fcc8ac89581e1625a05ef54cee9ce8d3a48a8144
SHA256

9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40
SHA512

bc2a13759e87b6e6bdabdcaaabd6d30204ea86fc1bcb1ee8586f1aa7453247bd4618e206bc126e57129c16f0806251a8243583f1035241c9adc55d81efe037d3

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\msoclient = "C:\\Users\\Admin\\Documents\\Microsoft-Security\\msoclient.exe"	9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe

pid	Process
592	9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe
592	9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe

description	pid	Process
Token: SeDebugPrivilege	592	9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe

C:\Users\Admin\AppData\Local\Temp\9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe
"C:\Users\Admin\AppData\Local\Temp\9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-118-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download