0a095f1820b0a16abf05a0b0de4c726bf1ec4a1cca8601a78d6a50b103e873a1

Analysis

max time kernel
161s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a095f1820b0a16abf05a0b0de4c726bf1ec4a1cca8601a78d6a50b103e873a1.exe
Size

56KB
MD5

207a9e7d49bf9e55e1c025c5bf08d236
SHA1

ac315cfaf067a05743ca0704e0d98ec84ef774cf
SHA256

0a095f1820b0a16abf05a0b0de4c726bf1ec4a1cca8601a78d6a50b103e873a1
SHA512

08c6812764f2ca3d3fd3cc00f12896af9c1a5de0f7e183a07719ec67152fd7134404d2faa920ba08ea524236388a0cece3379309000dcc3a90ea90d27356b97e
SSDEEP

1536:cgaYDduNo44w6fTRFZeNT5oyL1gABlEOt7uoF:cY506fTRFZ+Vpay/N7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe\""	0a095f1820b0a16abf05a0b0de4c726bf1ec4a1cca8601a78d6a50b103e873a1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	0a095f1820b0a16abf05a0b0de4c726bf1ec4a1cca8601a78d6a50b103e873a1.exe

C:\Users\Admin\AppData\Local\Temp\0a095f1820b0a16abf05a0b0de4c726bf1ec4a1cca8601a78d6a50b103e873a1.exe
"C:\Users\Admin\AppData\Local\Temp\0a095f1820b0a16abf05a0b0de4c726bf1ec4a1cca8601a78d6a50b103e873a1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4440-132-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/4440-133-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download