8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650

General

Target

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
Size

64KB
MD5

0e86092083ffba208aebcc2f2e06220f
SHA1

32a377256694bb76552166c907f027c3589eed70
SHA256

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650
SHA512

5e978d5135dbc435de0de732ceb82149833d7144796ec4574919c4cdbb786df6316a56d1c1bf16b47d328e601b3c2264a2d7b7488b500260f8cabf708399bcff
SSDEEP

1536:51uW8edOvxgZH72W0oGEhwSp7EH8IchAWckV5gjupoCafgLo:zN2bSp7k/chNl0jupHWgL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe"	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

pid	process
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

pid	process
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
1560	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

C:\Users\Admin\AppData\Local\Temp\8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
"C:\Users\Admin\AppData\Local\Temp\8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1560-132-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1560-133-0x0000000000880000-0x00000000008A1000-memory.dmp

Filesize
132KB

Download
memory/1560-134-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1560-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1560-136-0x0000000000880000-0x00000000008A1000-memory.dmp

Filesize
132KB

Download
memory/1560-137-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads