37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda

General

Target

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
Size

397KB
MD5

667671c5c6dfc089a09f1793a0181c91
SHA1

024d03dffd2c6ca2d48af8766f94633ab0cd0a0a
SHA256

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda
SHA512

a6321a7887f0390c61f08db17cef9b6a86c23d94e7f721939aca606a504cd8f45fffd5afbba2176a2871377dd6eebc5800f445f1f67fbcb7dcc01b07b2c9f660
SSDEEP

6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPX6uP:I+u9nx2GjMY3XKfd/H/9P1P

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe"	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

pid	process
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
2576	37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe

C:\Users\Admin\AppData\Local\Temp\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe
"C:\Users\Admin\AppData\Local\Temp\37e1cd3cdb43802a1df9d29e781fb64c9359561a58b3242d56588d30e2ea0cda.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2576

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads