5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605

Analysis

max time kernel
174s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605.exe
Size

96KB
MD5

4978b2ebfaa147b2d7bcd63fbcb3a97e
SHA1

8413398cce4b2846497a6bbf13cd56b19d606aba
SHA256

5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605
SHA512

69065287d0b6befaf069b1c72c1bfb4a279f75866a76c8bed49cb4af7d287ab1d6d1baeb43922eac8735e1861e1cacf112e61c9f9ba879a7f3cea04ab2b08d03
SSDEEP

1536:rkCG4PKbODh58eRb07ncaldeEP2vTxwDwSKPP8cGaLAy+uRZhOBJrgnNWa+++POw:rklqKIseRbEB7DqGaUyN+rqWa+++POUT

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6A807N6-42DF-4W02-93E5-B156B3FA8AL1}	5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6A807N6-42DF-4W02-93E5-B156B3FA8AL1}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ali.exe"	5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandook = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ali.exe"	5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605.exe

C:\Users\Admin\AppData\Local\Temp\5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605.exe
"C:\Users\Admin\AppData\Local\Temp\5d2cfc056201da59a21cd2c32f970dc2b2f05f84bee7f9f7eaaf882b9cae2605.exe"
1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:5104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5104-132-0x0000000076440000-0x00000000764BA000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads