d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1

Analysis

max time kernel
9s
max time network
45s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe
Size

824KB
MD5

7c46327b3125e91ec3029887513c2000
SHA1

6ca486b9548d45cda0f589f78359e0693ba42773
SHA256

d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1
SHA512

bc002671e96c6db13169d51f720a3446732c5c62a4781b047fd4f2019060fd66b50eba6e65a830d05e6355d05917cdc09606ea15df303bb1857d606318399d4d
SSDEEP

12288:QBWQbVyOLnj3Yev24QPaLRTNhq8TINT3OsGZiDx:QBWAguj3Xv2FaLtYNXGi1

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ÎÒµÄÆô¶¯Ïî = "C:\\Users\\Admin\\AppData\\Local\\Temp\\É«É«ÁÄÌìÊÒ°²×°"	d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe

pid	process
2012	d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe
2012	d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe
2012	d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe
2012	d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe

C:\Users\Admin\AppData\Local\Temp\d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe
"C:\Users\Admin\AppData\Local\Temp\d1619a68c1a3fda2a72c4b99f02cf13881c1511d3cf164ca8edf526a26f486b1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download