57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
24-07-2022 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
Size

30KB
MD5

91a9f7de616a839a9185452952f03f8b
SHA1

1bd5b3dbbfa4fc4209392149490268f15bdbe469
SHA256

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6
SHA512

638d5e5848a6a475840c645c0c264230b03c9f995d38b4674df081742f42145a18ffed5f342fa39b0c4bce69a6a9cdbc148224d1351f811e7c520a0c0f3584de

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe\" .."	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe\" .."	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

pid	process
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

description pid process

Token: SeDebugPrivilege 1072 57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

description	pid	process
Token: SeDebugPrivilege	1072	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

C:\Users\Admin\AppData\Local\Temp\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
"C:\Users\Admin\AppData\Local\Temp\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1072-55-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download
memory/1072-56-0x00000000749E0000-0x0000000074F8B000-memory.dmp

Filesize
5.7MB

Download