b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1

Analysis

max time kernel
397s
max time network
418s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe
Size

2.6MB
MD5

68c2de83c155c49b9e847adafa335600
SHA1

b7de298feaa9ed46d4fb0082970ad7f40bd94b81
SHA256

b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1
SHA512

dd457507850521cba70a744772315aefed7be520c0edba929dbbbb787e13dc749e5909277345085429666a2d910b54aba37b9262a92fde8c71a257d11d0aeb6e
SSDEEP

49152:GuALj3tVDtREWp2BaIEImdyHWg54b77tLI4LsNOz3bbXN65JryG8HJwnGu:PIDtVbfGa/ImdyHWk4TtLgs3XNMVyG8m

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\System32\\svchosts.exe"	b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avg = "C:\\Arquivos de programas\\avg.exe"	b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchosts.exe	b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe
File opened for modification	C:\Windows\SysWOW64\svchosts.exe	b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe
File created	C:\Windows\SysWOW64\Computador - COXNLIOB.txt	b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe

C:\Users\Admin\AppData\Local\Temp\b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe
"C:\Users\Admin\AppData\Local\Temp\b0082d85c182939cf5d8f45a70a15a1e038bdcf26393fae763256cf3f297e2d1.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-132-0x0000000000400000-0x0000000000CFD424-memory.dmp

Filesize
9.0MB

Download
memory/2148-133-0x0000000000400000-0x0000000000CFD424-memory.dmp

Filesize
9.0MB

Download
memory/2148-134-0x0000000000400000-0x0000000000CFD424-memory.dmp

Filesize
9.0MB

Download
memory/2148-135-0x0000000000400000-0x0000000000CFD424-memory.dmp

Filesize
9.0MB

Download