ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-en-20211208
submitted
01-02-2022 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8.exe
Size

899KB
MD5

4b982fe1558576b420589faa9d55e81a
SHA1

a858c92a664491d1195370c20f2e4fa6b6ae5c3c
SHA256

ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8
SHA512

85a73137296ed737b47e4eefe7723cb8979722a91cadca32815df0b59aa9a18d776c7d749e71bf6ec24d9daaa40ca7a57affafdca592c4b76adffa15d36d6622

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\msfsa = "C:\\windows\\tsay.exe"	ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\tsay.exe	ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8.exe
File opened for modification	C:\windows\tsay.exe	ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8.exe

C:\Users\Admin\AppData\Local\Temp\ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8.exe
"C:\Users\Admin\AppData\Local\Temp\ff84e79cae99f5714f363588bc8238096249a85d34982b8d8c9ac2f9c3a639e8.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/964-55-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download