f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87

Analysis

max time kernel
159s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe
Size

5.0MB
MD5

404c05e5e99e85909251966c6409e201
SHA1

20a1eba8fee623a6b68c29ea72d8931d176ec4ab
SHA256

f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87
SHA512

86e5702d5e234a01d708f9182400746981f25d3a1d230501b1139e8c7030f95d0fcaaa9a36e5baf6e14ea0cb3b5a3082316c5339f5226e336297474b9f69b917
SSDEEP

768:tO6Q2P6d4WeoUU08JFhfIz2yPhqE+cocFfbebLwvqXVSBBeR9RSNdm48us7qMo1s:i2BoLAz55b/FKEOVSBk9Rumvq9K

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
12345rewq

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tempManager = "C:\\Users\\Admin\\AppData\\RoamingtempManager.exe"	f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4632	f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe

C:\Users\Admin\AppData\Local\Temp\f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe
"C:\Users\Admin\AppData\Local\Temp\f907c2e2dad954fcac7153c37f84292c074becb7bf0245aae2a31992deaeff87.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4632-132-0x00007FFAA15F0000-0x00007FFAA2026000-memory.dmp

Filesize
10.2MB

Download