dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93

Analysis

max time kernel
132s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe
Size

987KB
MD5

10f704c5a45a26f0e68d4ef82b7ca4bc
SHA1

0b14750e195dc37275e8b5dfdcf0c8f5f8f70e83
SHA256

dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93
SHA512

7d54cbd1334736d5744d90bdb2260eb25fc6819d542a39203c4137559208e126ded889c8edd95168081e1a50bb39ee019ab8cf59ac3974ac6a04253f8d3fd654
SSDEEP

24576:Ot3v3WYu9tEkJT44m/+LkmgYkmxFAXGQdTBOWG:MWmiA3dYkmcGQdlOWG

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tiny download manager = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe\" /M"	dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1516	dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe
1516	dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1516	dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe

C:\Users\Admin\AppData\Local\Temp\dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe
"C:\Users\Admin\AppData\Local\Temp\dd6b00fed5eea0ab5a4d9606d9fd57cabd247c270ab774a85af1871ed7452e93.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/1516-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download