5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe
Size

24KB
MD5

6bfbc2b2a403ed8cd2d2b38a6b880d98
SHA1

4b8ef7b8e2dbb5f8c995c200307746b9d886ef04
SHA256

5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a
SHA512

0f2ff3b3aab60e8534972dfc3b0adbcc85a0956ed9f29866e4a9a5c2f79b4308096b25e94f1674a97681615305e4d5d7d7f793e261c0b920c29543ac6335ef5a
SSDEEP

192:LlvID2nmE6jPpZLuC+4EMMftAcBMXV62Z4dE91kYLU86XAvP:FIYmE6jul40MPSY15LCXu

Score

10^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\systray32.exe \"%1\" %*"	5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\systray32.exe	5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe
File opened for modification	C:\Windows\SysWOW64\systray32.exe	5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\systray32.exe \"%1\" %*"	5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe
3152	5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe

C:\Users\Admin\AppData\Local\Temp\5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe
"C:\Users\Admin\AppData\Local\Temp\5ffa12ee0e1b360f1ccdc92ae76910d8214f6384ca42188facaa945c035ab95a.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads