29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2022 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe
Size

347KB
MD5

799a7f1507e5e7328081a038987e9a6f
SHA1

7cd8dce5c61cda4e13b5865b67a7fb846ef9a627
SHA256

29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21
SHA512

a3f5a920dd53d31facb81fc5842654e53ad53d3bf6a0f935e9b152540a4b42e9a7da6e56e1243f914854ad0d1611646b8e98fe6ef725dff48c96715cdcc68197
SSDEEP

6144:ibslI7wgOZ1WMYORbmV9bAq11yVQhAyPl7/s:ibvwBEMtQAM1yVQhAyPl7/s

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sihost.exe.exe	29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\sihost.exe.exe\""	29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sihost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\sihost.exe.exe\""	29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe

C:\Users\Admin\AppData\Local\Temp\29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe
"C:\Users\Admin\AppData\Local\Temp\29c7d7d36a0c8acec88ff7aa34adc0f9240270a85e330fd2336408e1f0d52c21.bin.exe"
1⤵
- Drops startup file
- Adds Run key to start application
PID:3368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads