bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee.exe
Size

6KB
MD5

6dc1bf85fe9b004d5d5fe22846caac51
SHA1

774589a4098c52f76e9552155165b09ca67f5786
SHA256

bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee
SHA512

7ad6960b627958f989c0785d18343831ffc98ca7a6e2112f2d422bef94212894d2eefe14ee69d38b69923a55611206262a120663da387097f229fba2f5e76f9e
SSDEEP

96:sYDlCEpU7JyrrYw3zlueaym8xzXvuec8R4b7HTMNF4m+6yb:VBU7QrrYwDwyrEO+HwHV+6

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop	bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{357A87ED-3E5D-437d-B334-DEB7EB4982A3}	bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee.exe

C:\Users\Admin\AppData\Local\Temp\bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee.exe
"C:\Users\Admin\AppData\Local\Temp\bdce6b5a9514695a58371069236105f67ca7c8241d2ba368d95654c59ff66fee.exe"
1⤵
- Adds Run key to start application
- Modifies Control Panel
- Modifies registry class
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads