56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 01:05

Target

56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83.exe
Size

323KB
MD5

62500774f0b0b9f87980298bd465b1ee
SHA1

81850f0b3139a975f8f5f521bf039d352b79d2b2
SHA256

56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83
SHA512

14d7528bb3d51cb89d88a2f4a67a2e3035dfa058e5bfcac7682ff566aff9d23daf8c795999150a87576a00e7cc1877daa4bef718f04c796c1a9851cf605256f9

Score

10^/10

suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata: ET MALWARE ETag HTTP Header Observed at JPCERT Sinkhole
suricata
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops file in Windows directory 1 IoCs

Processes:

56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83.exe

description ioc process

File created C:\Windows\Tasks\FlavorFavors.job 56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83.exe

description	ioc	process
File created	C:\Windows\Tasks\FlavorFavors.job	56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83.exe

C:\Users\Admin\AppData\Local\Temp\56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83.exe
"C:\Users\Admin\AppData\Local\Temp\56fe03b41b09f2ec6acf3faa8065a2098d48ff023d4440458289ce76de57fc83.exe"
1⤵
- Drops file in Windows directory
PID:2000

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/2000-54-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/2000-55-0x0000000000200000-0x000000000022F000-memory.dmp

Filesize
188KB

Download