2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec

General

Target

2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
Size

556KB
MD5

207bb924d08efedf38dc6e627d4fc3de
SHA1

143719a12955990428fe15dc05a7c0acaa0c9947
SHA256

2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec
SHA512

f466d01bbb6e294e2ed3c0246bf2003259e9af8e77a0ed6ee4aaf95e729813d408987f37b39888ccc741f3d02cde5994ba13d7e5d7f1f37e58bdad9c2d12433a
SSDEEP

12288:D+u9nx2GjMY3XKfd/H/9PRdpLLpWRY6ke9KS:D+qnT9GH1PRdJL0S6D9t

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe"	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe

pid	process
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
3376	2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe

C:\Users\Admin\AppData\Local\Temp\2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe
"C:\Users\Admin\AppData\Local\Temp\2b0faba04d2c97fc501009d42373513c79cca36818805cb363313ab4759f4aec.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3376

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads