29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7

Analysis

max time kernel
148s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-06-2022 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe
Size

452KB
MD5

4b3c531bc19955b5ac4c781b9c893752
SHA1

954ed8f2b5eee6de1bc614aac9e691da12cbab34
SHA256

29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7
SHA512

3cf5ba7f292fb0b5c02e18514e672f8578de25fa56074ca6191c7a4718eff6b31da43b0ed75d77df7a47fd0d09cf6829c798f808d5e203c87baea033ba813dbb

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Monitor = "\"C:\\Program Files (x86)\\System32\\System32.exe\" -a /a"	29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "\"C:\\Program Files (x86)\\System32\\System32.exe\" -a /a"	29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1992	29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1992	29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe

C:\Users\Admin\AppData\Local\Temp\29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe
"C:\Users\Admin\AppData\Local\Temp\29b36089f2e26cc15bb3172d5f38bbb3bbb9f743264ce9d3aab9b96f07e547d7.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000074B50000-0x00000000750FB000-memory.dmp

Filesize
5.7MB

Download
memory/1992-56-0x0000000074B50000-0x00000000750FB000-memory.dmp

Filesize
5.7MB

Download