1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba

Analysis

max time kernel
406s
max time network
449s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe
Size

76KB
MD5

6c560b22a86cb230bb8adc2979251125
SHA1

df4b3f870dc432f3dcfb197059a0005058b42b5f
SHA256

1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba
SHA512

737374fde32eb6109e31ed1f251b25935c1e534fe5f1009bd9cc5ab09655d39a65af9729ff336b20449a8c12b325a9aa7608da5172d8be91dc8c79ca18d4ed5a
SSDEEP

1536:niSQYKxFxL44OdLfZDfYIPltZL59iSeV7:DKxFxLd+fZJPYB

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek HD ??? ??? = "C:\\Windows\\realteck.exe"	1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe

Drops file in Windows directory 2 IoCs

Processes:

1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe

description	ioc	process
File opened for modification	C:\Windows\realteck.exe	1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe
File created	C:\Windows\realteck.exe	1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe

pid process

1092 1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe

pid	process
1092	1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe

C:\Users\Admin\AppData\Local\Temp\1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe
"C:\Users\Admin\AppData\Local\Temp\1300d70fca05243dda1d22c1a3fe408595825593cebc424778d816c8a4a970ba.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads