d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe
Size

37KB
MD5

463b3177af2dcc317ba1611b7c8ab48d
SHA1

44bcdb401506831a1e3da2b4d4a553a53e73d1a1
SHA256

d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086
SHA512

6870893bb98a7e327b367e7fef86c69674f171b3ccd8bd51dbda79740f7585aa202e33a72d1770f3a25fcae23cb43c6a3e25a7c18b96aa1251c584801978a0f7
SSDEEP

768:1YFD8Bd8yLspnm2NeJBIcRnL5ZJ3lJ1snqnRz7QLo/5:1YFgnItbNe3IgjjjsqR/b5

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\12CFG515-K641-55SF-N66P = "C:\\RECYCLER\\S-1-5-21-0243636035-3055115376-381863306-1556\\pqlmq.exe"	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\RECYCLER\S-1-5-21-0243636035-3055115376-381863306-1556\Desktop.ini	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
604	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1276	604	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe	15
PID 604 wrote to memory of 1276	604	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe	15
PID 604 wrote to memory of 1276	604	d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe
  "C:\Users\Admin\AppData\Local\Temp\d7168ad95d44001fa0c1479d710c642baac2d32a1360de5ee62eded4fc321086.exe"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-54-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download