f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c

Analysis

max time kernel
182s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe
Size

9.0MB
MD5

e4d1ebb4dc322c76912c772d2cbb2170
SHA1

784cd685887879a46a9fa5ca5b89e2ef80658829
SHA256

f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c
SHA512

9e8ebfdde355c7c28b7aa3d042e689012c333985ea7a15783ab9de91092f8b0a4918f83119519e9ea5e449df10338b2628024d8a21761c8eae43bf6caf8880c4
SSDEEP

98304:MWbgOJu6pLgcqM9cNSbIJC0tfjhq3DDDak/qHgzT+Zq5l5zQMD:aMuL/SE80tfczMIT5nzQM

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ReceitaFederal = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe"	f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe

pid process

5012 f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe

pid	process
5012	f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe

C:\Users\Admin\AppData\Local\Temp\f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe
"C:\Users\Admin\AppData\Local\Temp\f5987125fa09a91f34be44b2055819fe859c7c416b06bacf6fc6170865faf56c.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:5012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads