06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe
Size

96KB
MD5

45541ce144095d1673c7b73390575dc0
SHA1

85fbf033d4de3a55ac68f806c889d4dad32b6ced
SHA256

06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d
SHA512

fa2974b16c7df841a755dfb92ca50865f1e09ac19c24b803eaf60fab37f40fc0d29837a210274861b59509e7d90924bc9b98ac4bc6a48bdc825f41c99754f9ae
SSDEEP

1536:TgE0XucRgYClJIElJSs2B7JXrAB1772nzC/UFEEO:TgEOucqlJ7lJduZAB17iu/UFEEO

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d = "c:\\windows\\06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe -m"	06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

Processes:

06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

description	ioc	process
File created	\??\c:\windows\06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe	06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe
File opened for modification	\??\c:\windows\06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe	06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

pid process

624 06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

pid process

624 06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

pid	process
624	06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

pid	process
624	06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe

C:\Users\Admin\AppData\Local\Temp\06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe
"C:\Users\Admin\AppData\Local\Temp\06266352b4315f441ff01c9f3a81a60fcefb976a2c7a7570eec03db9268d534d.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download