fd3c05c88eb8d7d52f9f995ed74094d41e097a96cbee78f70a278e5b04cdf0d4

Analysis

max time kernel
200s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd3c05c88eb8d7d52f9f995ed74094d41e097a96cbee78f70a278e5b04cdf0d4.exe
Size

24KB
MD5

0f2e82a25b3218294986654cb0edcfee
SHA1

d35a72101cffd9dc005be637451f5fb355c9993a
SHA256

fd3c05c88eb8d7d52f9f995ed74094d41e097a96cbee78f70a278e5b04cdf0d4
SHA512

cc7c8ee0f0ae57012a80e3dbcfa01a547a52219bea19da0e2170c37b2493cd063032c28485a6ab56061bf5d89d1f92e5fbe6c0c16eeaaac48b385275c81a3f74
SSDEEP

384:vcjuz+CJlxXpX5t37+qXInYDxRuvaP2XOzm63y1+0yajuEh3Dy:N+epX5J71sYDx9zmc0yajh3O

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sx621 = "C:\\Users\\Admin\\sx621.exe"	fd3c05c88eb8d7d52f9f995ed74094d41e097a96cbee78f70a278e5b04cdf0d4.exe

C:\Users\Admin\AppData\Local\Temp\fd3c05c88eb8d7d52f9f995ed74094d41e097a96cbee78f70a278e5b04cdf0d4.exe
"C:\Users\Admin\AppData\Local\Temp\fd3c05c88eb8d7d52f9f995ed74094d41e097a96cbee78f70a278e5b04cdf0d4.exe"
1⤵
- Adds Run key to start application
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1268-133-0x0000000009000000-0x0000000009007000-memory.dmp

Filesize
28KB

Download
memory/1268-134-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/1268-135-0x0000000000420000-0x0000000000428000-memory.dmp

Filesize
32KB

Download
memory/1268-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download