aabc6ff33a3f452b078af0159a663eb03b66678d2dd37aa076f89e1247847c8d

Analysis

max time kernel
144s
max time network
139s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aabc6ff33a3f452b078af0159a663eb03b66678d2dd37aa076f89e1247847c8d.exe
Size

15KB
MD5

6604f28c302d8c7392f972d7f36565d9
SHA1

7a467fc13c6fec8f8b95a98e61b10035d0e050fb
SHA256

aabc6ff33a3f452b078af0159a663eb03b66678d2dd37aa076f89e1247847c8d
SHA512

b7875cdbf3f6627d541b7ee0fa2c0155ad2f21496621998799865c3457c79f5ef67f6a539322d8e1b9779c7a98da46330dd4d481edf7129e0a7769dc45da553c
SSDEEP

192:SD7hEiuZWDKf7uOdOgbS6vPh1tqHsiM0qWgjFORBM+:Sv/IcwOgF4sXm

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1964	aabc6ff33a3f452b078af0159a663eb03b66678d2dd37aa076f89e1247847c8d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	aabc6ff33a3f452b078af0159a663eb03b66678d2dd37aa076f89e1247847c8d.exe

C:\Users\Admin\AppData\Local\Temp\aabc6ff33a3f452b078af0159a663eb03b66678d2dd37aa076f89e1247847c8d.exe
"C:\Users\Admin\AppData\Local\Temp\aabc6ff33a3f452b078af0159a663eb03b66678d2dd37aa076f89e1247847c8d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\732E.tmp

Filesize
1.7MB

MD5
b5eb5bd3066959611e1f7a80fd6cc172

SHA1
6fb1532059212c840737b3f923a9c0b152c0887a

SHA256
1ffb68a66f28f604adcae9c135f8dcf301316ab7fda8ebd294583c56dd26f7cc

SHA512
6c0743e0ff4922e859ba66b68040ab994dbae33e80c63ce8c993ad31a0c7aad6c6467484da1550063214953cd641dbf597438dd0c02f24164505d88ca80ea1b6

Download Submit
memory/1964-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download