6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693

General

Target

6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
Size

498KB
MD5

4842aad457fdcd7da02efecba7e4ae72
SHA1

2d48c2319d4319caedb76ba8ae931def211fc41f
SHA256

6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693
SHA512

ba168d8be6cc2725e101b8a6c62e1941c431529060c8f0d384846e8119f86431263dce3f3ace57cfc24d3fa53cb52f33ab3f7d139881c32f2a1ebea455fd8e51
SSDEEP

6144:bLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXI:H+u9nx2GjMY3XKfd/H/9PI

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe"	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe

pid	process
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
2500	6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe

C:\Users\Admin\AppData\Local\Temp\6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe
"C:\Users\Admin\AppData\Local\Temp\6d5ed2249815975fad15d89d0bf9c197e9b83a4fe8723a1b91885d66a26ea693.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2500

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads