c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe
Size

388KB
MD5

45c27ad72d33a9f66e11dc05b3d5261b
SHA1

2923cd258d4b50f1c996e0035a82f65575d985e9
SHA256

c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c
SHA512

c226da9029b39abfc1712e9757ddb330c588e21aee3293089c0c06e070ac1649ddcac07af96b90de203e67b512f3db93f64cc6798d5e3a686dfe82590666a342
SSDEEP

6144:WtW//YeguGc6nDoDLVVwK9lZ7EY1w4SFph9AKLmTSL5x4z6gdZHRl:h//dguGc6nMwYfLWphX5x466/

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SysCom = "C:\\WINDOWS\\system\\msnmsgr.exe"	c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system\msnmsgr.exe	c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe
File created	C:\Windows\Menu Iniciar\Inicializar\msnmsgr.exe	c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe
File created	C:\WINDOWS\system\msnmsgr.exe	c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe

C:\Users\Admin\AppData\Local\Temp\c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe
"C:\Users\Admin\AppData\Local\Temp\c859e5e87d104ee09733c42e94c332248a6fbe131e83d3bb9967adcf47229e1c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads