fa23102e1c3eccaa2b9b057eea06a2df0b17ef40619d3ca2abce058acd2b34af

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa23102e1c3eccaa2b9b057eea06a2df0b17ef40619d3ca2abce058acd2b34af.exe
Size

492KB
MD5

689e439775144f74d2df34f0c2299295
SHA1

b11db9368698ff8e4fcc28a49bfc52fa70240ef3
SHA256

fa23102e1c3eccaa2b9b057eea06a2df0b17ef40619d3ca2abce058acd2b34af
SHA512

7e6a14f0875bf98e277643d43d556f9a052e1d6e157505384380b7707773020617512904aecf113d4cea6866064309d202c3c139363fdeb09fcd4bbd0186d354

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fa23102e1c3eccaa2b9b057eea06a2df0b17ef40619d3ca2abce058acd2b34af.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\jcopE = "C:\\Users\\Admin\\AppData\\Local\\jcopEP\\jcopEPUoc.hta"	fa23102e1c3eccaa2b9b057eea06a2df0b17ef40619d3ca2abce058acd2b34af.exe

C:\Users\Admin\AppData\Local\Temp\fa23102e1c3eccaa2b9b057eea06a2df0b17ef40619d3ca2abce058acd2b34af.exe
"C:\Users\Admin\AppData\Local\Temp\fa23102e1c3eccaa2b9b057eea06a2df0b17ef40619d3ca2abce058acd2b34af.exe"
1⤵
- Adds Run key to start application
PID:1876

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1876-54-0x0000000000170000-0x00000000001F0000-memory.dmp

Filesize
512KB

Download
memory/1876-55-0x0000000001EB0000-0x0000000001F00000-memory.dmp

Filesize
320KB

Download
memory/1876-56-0x0000000001F70000-0x0000000001FA6000-memory.dmp

Filesize
216KB

Download
memory/1876-57-0x0000000001F00000-0x0000000001F03000-memory.dmp

Filesize
12KB

Download