9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387

Analysis

max time kernel
170s
max time network
208s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387.exe
Size

16KB
MD5

eabc809f5d92b736c98199952934d6e5
SHA1

2d33fc55b1e4966a9e684d56f038384679537e35
SHA256

9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387
SHA512

a1bf145584463ced6ecf7155169a4ba241bd123b049a69517cde0ebd552ab643f5f76825bf15b960584df9ade858dc20e0f978e31d1fa3f885bc178b639d8c2b
SSDEEP

384:mU/pmP17h5tZhMyqJUJMvwNupeXfv7d3h44Ts9vr6pWt61IuE1kcftj:mMMpT2UYqvg9dt8D2tj

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zxcd = "c:\\WINDOWS\\system32\\runr.exe"	9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runr.exe	9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387.exe
File opened for modification	C:\Windows\SysWOW64\runr.exe	9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387.exe

C:\Users\Admin\AppData\Local\Temp\9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387.exe
"C:\Users\Admin\AppData\Local\Temp\9b640cfb430a57290151143f84230f0409e9df73de82254b0ceb887ec7378387.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download