7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f

Analysis

max time kernel
4s
max time network
9s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Size

384KB
MD5

9d37c2d88562bf9520bbc8186c28dddd
SHA1

3cb57cbab6a3ca96cda1188d09a8f084c8ab3b78
SHA256

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f
SHA512

bee4f83b1b1e284065f1a7dd08309007cfeef05e3319d6cc0d22259d51be919bbf82a99b83171cbf9af62ce94c53236f20510d9baef551969718e62213fec98e
SSDEEP

6144:W6YkTLi7oZ83Rl/M01nQgDB3rd3GVhwRlMJjORq5vuaYm/DFDs:kkHi7oC3R+01n3DGaTsjG6DBs

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

pid process

5080 7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

pid	process
5080	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YortoTihiq = "regsvr32.exe \"C:\\ProgramData\\YortoTihiq\\YortoTihiq.dat\""	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

Modifies registry class 2 IoCs

Processes:

7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{7D2E5F72-151F-435B-9CCC-6E3D021369C0}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c376336353032383064306161393832386665623831663837633831316664356638653533613834633631316161623539393032623736326564376430396430662e65786500	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{7D2E5F72-151F-435B-9CCC-6E3D021369C0}	7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe

C:\Users\Admin\AppData\Local\Temp\7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe
"C:\Users\Admin\AppData\Local\Temp\7c650280d0aa9828feb81f87c811fd5f8e53a84c611aab59902b762ed7d09d0f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\YortoTihiq\YortoTihiq.dat

Filesize
288KB

MD5
9f7172eb65fc3f7e5b32578a3b3693c4

SHA1
d40340b67adbfbf0c1038aefac6ae72400fff365

SHA256
0a59adf6d1f6c1ac7d0a164812dee28aad434055d9acb3a9953341263de572da

SHA512
cf1f3b7091ad0856e711ac84afec3b4aaee2823f3cbde679ad8d19bb5591c0bcaec9d72c38de7cf4c81a3e65d9ea0aa0cb5aee8a4e4e03ad5e1774bf68c63d8f

Download Submit
memory/5080-132-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5080-135-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/5080-136-0x0000000075360000-0x0000000075393000-memory.dmp

Filesize
204KB

Download