711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484

Analysis

max time kernel
1s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484.exe
Size

2.2MB
MD5

4a7110cad71727922b9a0a06cfe5ba23
SHA1

4bcfd50a52c31e115f59eae45449f01ae65b8482
SHA256

711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484
SHA512

428ddee2b1bcbba0043357ed687ebc73e490d4cdae58856ae2040813cfef8a1bdadeebca1903868865ea18223033d82d8682e95145c59e974108f788d7753322
SSDEEP

24576:6oeoxiPPRN6ZeVeaa7a/HVGo5dW8dxamvsLMB9ZBGSvOqzWX+HywBHKOY2sVR5ns:6m8PPRso5BTdb5fZwSnWdOYXVRMd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\KennyShouldLive = "c:\\information\\UserSystem.exe"	711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484.exe

C:\Users\Admin\AppData\Local\Temp\711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484.exe
"C:\Users\Admin\AppData\Local\Temp\711776ad37dcdccc8890dfaa6fd609dcb4bc2c795d8c134a42ff8e2aee468484.exe"
1⤵
- Adds Run key to start application
PID:1352

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download