8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584

Analysis

max time kernel
39s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe
Size

3.1MB
MD5

bf8f7968dfb321b332131d63f85e3c0a
SHA1

886a523f07047bbdd7d26f907c87746c8996182e
SHA256

8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584
SHA512

153ee438a70c9efb72be5c91a0eb5db6c59401a5848e2e96dd5c55572fc33bd9d55d8ea564e4b5e7ee8643793432e141441dff60c8df3b7825b768af72ac24bd
SSDEEP

24576:Nvs5BtfJRm1lcY126Wg20Gdvewmj1CTy+0ZEqAq:N+jm1eIWg2vd/T/0iqAq

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinetWork = "C:\\Windows\\MEDIA\\WinetWork.exe"	8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe

C:\Users\Admin\AppData\Local\Temp\8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe
"C:\Users\Admin\AppData\Local\Temp\8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe"
1⤵
- Adds Run key to start application
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download