57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6

General

Target

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
Size

30KB
MD5

91a9f7de616a839a9185452952f03f8b
SHA1

1bd5b3dbbfa4fc4209392149490268f15bdbe469
SHA256

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6
SHA512

638d5e5848a6a475840c645c0c264230b03c9f995d38b4674df081742f42145a18ffed5f342fa39b0c4bce69a6a9cdbc148224d1351f811e7c520a0c0f3584de

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe\" .."	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe\" .."	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

Processes:

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

pid	process
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

description pid process

Token: SeDebugPrivilege 1320 57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

description	pid	process
Token: SeDebugPrivilege	1320	57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe

C:\Users\Admin\AppData\Local\Temp\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe
"C:\Users\Admin\AppData\Local\Temp\57ca0196a55df6df62972b4e9cb03bd0194ff5a6aad1510c63f30a20cf3057b6.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-130-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download
memory/1320-131-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing