f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87

Analysis

max time kernel
43s
max time network
85s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe
Size

5.0MB
MD5

404c05e5e99e85909251966c6409e201
SHA1

20a1eba8fee623a6b68c29ea72d8931d176ec4ab
SHA256

f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87
SHA512

86e5702d5e234a01d708f9182400746981f25d3a1d230501b1139e8c7030f95d0fcaaa9a36e5baf6e14ea0cb3b5a3082316c5339f5226e336297474b9f69b917
SSDEEP

768:tO6Q2P6d4WeoUU08JFhfIz2yPhqE+cocFfbebLwvqXVSBBeR9RSNdm48us7qMo1s:i2BoLAz55b/FKEOVSBk9Rumvq9K

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\tempManager = "C:\\Users\\Admin\\AppData\\RoamingtempManager.exe"	f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
936	f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe

C:\Users\Admin\AppData\Local\Temp\f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe
"C:\Users\Admin\AppData\Local\Temp\f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-54-0x000007FEF47D0000-0x000007FEF51F3000-memory.dmp

Filesize
10.1MB

Download
memory/936-55-0x000007FEF34F0000-0x000007FEF4586000-memory.dmp

Filesize
16.6MB

Download