b728fa9c7174abe58196c97e60ff969e6c884b1c8dfda2624072e89cedd392c4

Analysis

max time kernel
151s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b728fa9c7174abe58196c97e60ff969e6c884b1c8dfda2624072e89cedd392c4.exe
Size

133KB
MD5

384b4a36a8e0605ddb32a3fbafa59267
SHA1

158eaed6b8585930d0e2fdcf8b29b4629a1b64d7
SHA256

b728fa9c7174abe58196c97e60ff969e6c884b1c8dfda2624072e89cedd392c4
SHA512

6e6dd2d40a078dc8f4c389317cd7fe1455dc9ce98b4445570f67cddf05a3ee7ab9ac2e7ed9913e84868931b63afb4fbfd9d3ebd71de271f5eef341a4a37337bd
SSDEEP

3072:qc9Dbfkn/jJgRCSDOSJjj7sN3Lms5bFl/Jic:qEbsn/1gRCiJjUm6rM

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	b728fa9c7174abe58196c97e60ff969e6c884b1c8dfda2624072e89cedd392c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d1d1c8d4d3d4dd94dfc2df = "C:\\Users\\Admin\\AppData\\Roaming\\ning.exe"	b728fa9c7174abe58196c97e60ff969e6c884b1c8dfda2624072e89cedd392c4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b728fa9c7174abe58196c97e60ff969e6c884b1c8dfda2624072e89cedd392c4.exe
"C:\Users\Admin\AppData\Local\Temp\b728fa9c7174abe58196c97e60ff969e6c884b1c8dfda2624072e89cedd392c4.exe"
1⤵
- Adds Run key to start application
PID:4808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...