96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d.exe
Size

340KB
MD5

334c3358c034d35c69f10887fbdc5696
SHA1

46ad7b965ee48bd48ffda171559f5a5b06e1914f
SHA256

96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d
SHA512

2192656ba3971d3c8ae51629585949bafb88ce433da47f91fda1cdb5f7d2df47bff6023b173414a7bf16cdcff8301882bd99c1474bf79d2935c24a5dd4d1a4c0
SSDEEP

6144:q1IB0MhsBFKs1JfBbXJTmk8Vz1E5XhTbyZOlPrtTiXB7Ns0+:q22Mds1dd8U5yZOlEx7GJ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\SfKg6wIPuS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d.exe"	96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d.exe

C:\Users\Admin\AppData\Local\Temp\96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d.exe
"C:\Users\Admin\AppData\Local\Temp\96653a55fefd70416b3f785bb7e5a9817013e3b40275780b42d37778232e425d.exe"
1⤵
- Adds Run key to start application
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download