8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe
Size

19KB
MD5

a43e6b1b69383b3d62e938ad9343e4c1
SHA1

100cba5f0f0b687ac640d874d3dc014abd1109d0
SHA256

8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f
SHA512

1f674c1134bbf22821b6dae1491dc3474116a0cb60415d24f97ea05e897c5ad54bc94f954acf28265f0433881beb7d3b6a2c2c067c3c575827f63752daad7a7f
SSDEEP

384:HHhF9RjW8tc9m32J5onumP0azeg4ShJBjESFfY0+SSFtEEtl:HHx9tccGDoum8all9fJ+bFtEEtl

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Flash Update = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FlashUpdateSvc.exe"	8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe

pid process

956 8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe

description pid process

Token: SeDebugPrivilege 956 8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe

pid	process
956	8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe

description	pid	process
Token: SeDebugPrivilege	956	8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe

C:\Users\Admin\AppData\Local\Temp\8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe
"C:\Users\Admin\AppData\Local\Temp\8735b6c6eb63573e567b1eb1975738115c1144416de0451d9856f64667f0317f.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/956-55-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download