fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb

Analysis

max time kernel
401s
max time network
402s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe
Size

1.9MB
MD5

ad9eac0ed90dd646bcd2ae091d0e19c3
SHA1

5830ce2b1646b435b6fa800815bb01e42ce7343b
SHA256

fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb
SHA512

8eba72f1649f8018ea310663d93199e7d5452c3e42dd3a3a9d0ecb960d32ed67291f7c2ea8ce12a03c686fcc1b47d7af8a0252b7b9a870fc6879d57c1b542f24
SSDEEP

49152:h7zDNYT8s1BkkT1lWnh5eIao1nEj5d2qA/5gfH7J/YnWL:9+8uBkGWnKoNEj5RA/YpYWL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows32 = "C:\\windows\\system\\wini.exe"	fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Menu Iniciar\Iniciar\WindowsUpdate.exe	fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe

C:\Users\Admin\AppData\Local\Temp\fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe
"C:\Users\Admin\AppData\Local\Temp\fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-132-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-135-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-134-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-133-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-136-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-137-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-138-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-139-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-140-0x0000000000400000-0x0000000001673000-memory.dmp

Filesize
18.4MB

Download
memory/2536-141-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download
memory/2536-142-0x0000000000400000-0x0000000001673000-memory.dmp

Filesize
18.4MB

Download
memory/2536-143-0x000000007FDF0000-0x000000007FE4C000-memory.dmp

Filesize
368KB

Download