8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe
Size

3.1MB
MD5

bf8f7968dfb321b332131d63f85e3c0a
SHA1

886a523f07047bbdd7d26f907c87746c8996182e
SHA256

8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584
SHA512

153ee438a70c9efb72be5c91a0eb5db6c59401a5848e2e96dd5c55572fc33bd9d55d8ea564e4b5e7ee8643793432e141441dff60c8df3b7825b768af72ac24bd
SSDEEP

24576:Nvs5BtfJRm1lcY126Wg20Gdvewmj1CTy+0ZEqAq:N+jm1eIWg2vd/T/0iqAq

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinetWork = "C:\\Windows\\MEDIA\\WinetWork.exe"	8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4752	8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe

C:\Users\Admin\AppData\Local\Temp\8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe
"C:\Users\Admin\AppData\Local\Temp\8eee87d24a51e241d4d8929c74b458abf224a7f418b88864dda8d6c21de5e584.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:4752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads