9a650c86652ba30a9b00580ff9ad9f5381f2df9b79379e3a5f90a824729974f9

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a650c86652ba30a9b00580ff9ad9f5381f2df9b79379e3a5f90a824729974f9.exe
Size

24KB
MD5

ca6f2c55811cca684d8fea30952b93ee
SHA1

1f402bb3a368f9a18c239d106d6abf699371871a
SHA256

9a650c86652ba30a9b00580ff9ad9f5381f2df9b79379e3a5f90a824729974f9
SHA512

e8de510486a4fb3ded18f51b7ae67211c10f14b74b38059c9448025cd45cd34d7eba6be2e879e2bf34219be3f336a528c533972367fc80798a1afda23d508c3d
SSDEEP

384:p6exbQfDFKqgyv8wnY7waVU/8avdfa9OK+CBDiwIIX9ajuEh3Dy:px0Y7wy0ndfzeiw/tajh3O

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\l0ym04fyv1 = "C:\\Users\\Admin\\l0ym04fyv1.exe"	9a650c86652ba30a9b00580ff9ad9f5381f2df9b79379e3a5f90a824729974f9.exe

C:\Users\Admin\AppData\Local\Temp\9a650c86652ba30a9b00580ff9ad9f5381f2df9b79379e3a5f90a824729974f9.exe
"C:\Users\Admin\AppData\Local\Temp\9a650c86652ba30a9b00580ff9ad9f5381f2df9b79379e3a5f90a824729974f9.exe"
1⤵
- Adds Run key to start application
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2044-55-0x0000000009000000-0x0000000009007000-memory.dmp

Filesize
28KB

Download
memory/2044-56-0x0000000000360000-0x0000000000368000-memory.dmp

Filesize
32KB

Download
memory/2044-57-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download