2c7f86463ea0fbf195720c48288ec7fe03abec474b210865255bcf50e6108d94

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416/57b3e371843add6e8c0c6c146deec48661318c5326514570e7bad0b948f196ad.exe
Size

35KB
MD5

dbb82c0ea8d9cc0e10cdf4af55ab097e
SHA1

8aa3b0f2997b5c70fb19ab69ff3c5eb6b861a214
SHA256

57b3e371843add6e8c0c6c146deec48661318c5326514570e7bad0b948f196ad
SHA512

46d83b7eb4553cece94ec96c600d533a566ea0fb354fb81674a99256c712a109c1c7dda80ca2794297c8816c55ded08de97fdbc919c26c016b8652163334714a
SSDEEP

768:y1DyElcWWdUFSvnfKYmsGSmRcVRG5cKocc9vRZrfJr:yAElbWdUF6nCY5ccVRZxr

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

57b3e371843add6e8c0c6c146deec48661318c5326514570e7bad0b948f196ad.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateHost = "C:\\Users\\Admin\\AppData\\Local\\Update\\Updater.exe"	57b3e371843add6e8c0c6c146deec48661318c5326514570e7bad0b948f196ad.exe

C:\Users\Admin\AppData\Local\Temp\416\57b3e371843add6e8c0c6c146deec48661318c5326514570e7bad0b948f196ad.exe
"C:\Users\Admin\AppData\Local\Temp\416\57b3e371843add6e8c0c6c146deec48661318c5326514570e7bad0b948f196ad.exe"
1⤵
- Adds Run key to start application
PID:1388

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x0000000000F90000-0x0000000000FA0000-memory.dmp

Filesize
64KB

Download
memory/1388-55-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download