88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568

Analysis

max time kernel
124s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe
Size

987KB
MD5

b5cbf0269e7274c0c93f4d275cd9fd3b
SHA1

4bbeeb935612f8f50290b47864ec76c452dbe64f
SHA256

88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568
SHA512

fe1f7fe142b3e29f4eb66b51fe74d997d0e8eae8625af492875fe8caf696a621c3023a42d4aea23d35b8434880e42deabbbce36d6b397d82bee33499e0764cc1
SSDEEP

24576:Ot3v3WYu9tEkJT44m/+LkmgYkmxFAXGTdTBOWG:MWmiA3dYkmcGTdlOWG

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tiny download manager = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe\" /M"	88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
956	88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe
956	88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
956	88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe

C:\Users\Admin\AppData\Local\Temp\88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe
"C:\Users\Admin\AppData\Local\Temp\88850fa371c9ec783b29ea0693d099e06a0945a5302e11d99feaf14bcdd5e568.exe"
1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/956-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download