2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73

Analysis

max time kernel
153s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73.exe
Size

556KB
MD5

3b81cd92f47c426bde45132d9df5b8f9
SHA1

352a567928beb9483f81bcb7b3795683a80c3305
SHA256

2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73
SHA512

1a5b35427a605372525326213865d66d87df401cb0ccaeeea9e59f1fb544411cea66fc498e535a464b6f7d057946fea98e4afeaea3ae8d1b9ed9e7a39871fa6b
SSDEEP

6144:gs833CnotE7RN8JRHnzOXYk0qqYMkn6U+Hjpu22LY8SQYMS86TBYAUM06OvCOOKY:mLtE7RaXzmiFYM7Uyj2LYealxUf9vW9l

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System-Service = "C:\\Windows\\SYSTEM\\EXPLORER.SCR"	2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SYSTEM\EXPLORER.SCR	2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73.exe
File opened for modification	C:\Windows\SYSTEM\EXPLORER.SCR	2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73.exe

C:\Users\Admin\AppData\Local\Temp\2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73.exe
"C:\Users\Admin\AppData\Local\Temp\2df0a8713575fd6e39afc3ace19a009325a9d3969b02f3dc332cba165aee8d73.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download