93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51

Analysis

max time kernel
147s
max time network
176s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51.exe
Size

128KB
MD5

22a4c70f0ae12c916ebc304f11059ce6
SHA1

ebbd2c520f4fe882c2f92503416b6928a409ea41
SHA256

93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51
SHA512

bac843dc21d0c6a4cf56e11a45de7992d6fa497ecfb769ba822c7723307a07a83749a6aa0c6c8ac68b5f7545b4c7549afa13c0a6d2cf5fdd00167149232b7779
SSDEEP

3072:bIWiL07ILGI7I2uZU8sPqP336L26MNz7BEv1:bIWiL0I17XuZU8kqPaL26M97K

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ISG = "C:\\Users\\Admin\\AppData\\Local\\Temp\\93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51.exe /cs:1 "	93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\	93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51.exe

C:\Users\Admin\AppData\Local\Temp\93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51.exe
"C:\Users\Admin\AppData\Local\Temp\93deaf7cce52e3d1418cae80406e09906f35f58d0a159d1eb03e6524c3356d51.exe"
1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Security Software Discovery

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-54-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/844-55-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/844-56-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/844-57-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/844-58-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/844-59-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download