fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0.exe
Size

199KB
MD5

066afd09a3e79d3821dc36dd950bc510
SHA1

6d837a0b42b3f5da2d7641ad024bee3d8b06a45d
SHA256

fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0
SHA512

0d0d961b2b5d258230aa9a961dfc31261408d0e1fa2c905556d2f617f90408a4f2b7b6d323a37e4602f1d8cdc0467997ec35ef8d3a50ae730c869c262de6677e
SSDEEP

3072:blYkCzJYIaQjEHX51JI20dLuJHUZp4FKPsy3dr:bAVdaQoHp1IdLAHUr3Lx

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Drive32 = "C:\\Windows\\system32\\videodriver.exe"	fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\videodriver.exe	fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0.exe
File opened for modification	C:\Windows\SysWOW64\videodriver.exe	fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0.exe

C:\Users\Admin\AppData\Local\Temp\fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0.exe
"C:\Users\Admin\AppData\Local\Temp\fb8c1f4db24332c1a27bc049604745b7a33e48b3c72e762398210fd6cce16cc0.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download