ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891

Analysis

max time kernel
119s
max time network
136s
platform
windows10_x64
resource
win10-en-20211208
submitted
30-01-2022 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe
Size

196KB
MD5

b0ef2ab86f160aa416184c09df8388fe
SHA1

8850568c6d7a12ec70b7fd0fc5944539a5a91d51
SHA256

ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891
SHA512

6b18b51b3de8e98411e17e55f977b6c991bc06505fd730f6830c24187e703cfd756e297caea2d72ed19a256de2025ddb6b25da67cf13e12d43529891a1100a3f

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\javabackup = "\"C:\\Program Files (x86)\\Common Files\\javabackup.exe\""	ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe

pid	process
3672	ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe
3672	ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe
3672	ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe
3672	ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe

pid	process
3672	ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe
3672	ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe

C:\Users\Admin\AppData\Local\Temp\ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe
"C:\Users\Admin\AppData\Local\Temp\ae4f669a9e3b9e220a5f32d0a43159083ee64482ca2897072e0f5752371b5891.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3672

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3672-115-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/3672-117-0x0000000000B30000-0x0000000000B3A000-memory.dmp

Filesize
40KB

Download
memory/3672-119-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download