bc6f514a559debc034932608009705f89d7fd174e41dc074cb552ed00702d44b

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc6f514a559debc034932608009705f89d7fd174e41dc074cb552ed00702d44b.exe
Size

162KB
MD5

83c7ecea5cfc3fd86a1fd68ca8659200
SHA1

47f21778b5a9838598d9c048088c368c52b7ac1d
SHA256

bc6f514a559debc034932608009705f89d7fd174e41dc074cb552ed00702d44b
SHA512

ab8abdf2cdb39e9a4882a29302ba93de05209acb4c859316eba60f74ba5ed36a83dba864e792fde8e9ba2f902dd2cc9bffbe000a3009e8d1980b366112b0abcf
SSDEEP

1536:HivC1Uj8vYuGq+OCzlrNCGspfE2x46pKszS6iUclg+pfLbiXMQfL9Aes5gFkx:HivC1aCkq+1zls9f87U+gQLbiL9AX5cy

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SoftupNotify.exe = "C:\\Documents and Settings\\All Users\\¡¸¿ªÊ¼¡¹²Ëµ¥\\Ç¿Á¦Ð¶ÔØµçÄÔÉÏµÄÈí¼þ.lnk"	bc6f514a559debc034932608009705f89d7fd174e41dc074cb552ed00702d44b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	bc6f514a559debc034932608009705f89d7fd174e41dc074cb552ed00702d44b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\bc6f514a559debc034932608009705f89d7fd174e41dc074cb552ed00702d44b.exe
"C:\Users\Admin\AppData\Local\Temp\bc6f514a559debc034932608009705f89d7fd174e41dc074cb552ed00702d44b.exe"
1⤵
- Adds Run key to start application
PID:2500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads