37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda

General

Target

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
Size

397KB
MD5

667671c5c6dfc089a09f1793a0181c91
SHA1

024d03dffd2c6ca2d48af8766f94633ab0cd0a0a
SHA256

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda
SHA512

a6321a7887f0390c61f08db17cef9b6a86c23d94e7f721939aca606a504cd8f45fffd5afbba2176a2871377dd6eebc5800f445f1f67fbcb7dcc01b07b2c9f660
SSDEEP

6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPX6uP:I+u9nx2GjMY3XKfd/H/9P1P

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe"	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

pid	process
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2028	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

pid process

2028 37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

explorer.exe

description pid process

Token: SeShutdownPrivilege 1104 explorer.exe

description	pid	process
Token: SeShutdownPrivilege	1104	explorer.exe

C:\Users\Admin\AppData\Local\Temp\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
"C:\Users\Admin\AppData\Local\Temp\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2028

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:1104

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-55-0x000007FEFBEA1000-0x000007FEFBEA3000-memory.dmp

Filesize
8KB

Download
memory/2028-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads