c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c

Analysis

max time kernel
97s
max time network
219s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Size

65KB
MD5

4d714abaaced606f6bd8b351ea72344f
SHA1

053c63e83e4e6560e41b5a46e77c747f11ead195
SHA256

c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c
SHA512

a0a3bd05662c9acafc006ea4dd4d7a5fc07fd89332e53bb3381328935a38c6cfe6dc71c6a400f6e52a3523badb37f7371d8c7980839b35ae412d6d36bef86cb4
SSDEEP

1536:1IkqoVs9UR4vHaEktPivrFmtc/lHEq4aYxlVEDmd6wQw/2HXcG:SUVOL6Ekt6Fynq4aYTVEDmBH2HX

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Windows32KernelStart = "\"C:\\Users\\Admin\\AppData\\Roaming\\wks.exe\""	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunServices	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunServices\Windows32KernelStart = "\"C:\\Users\\Admin\\AppData\\Roaming\\wks.exe\""	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows32KernelStart = "\"C:\\Users\\Admin\\AppData\\Roaming\\wks.exe\""	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows32KernelStart = "\"C:\\Users\\Admin\\AppData\\Roaming\\wks.exe\""	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices	c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe
"C:\Users\Admin\AppData\Local\Temp\c3253c44bc6c732ed5748fb386b33c4249cbf7f72591714e417edbf1fd96d68c.exe"
1⤵
- Adds Run key to start application
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmp

Filesize
8KB

Download