16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe
Size

466KB
MD5

6238eeaa05142294a413acae26dbd839
SHA1

3933247936a98d86398a079ef970e5cf6c65605b
SHA256

16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338
SHA512

17343f3b36e3d85223dbb97fd498b87d862d12ec16781efda9424f5aaf87a0c3a5b561d40e67d11a7b593c120266404f6614781bb59c57322eaeeb0c63b4cd04
SSDEEP

6144:vw9/WoGEtW9jW2sgShXxrmVV2PEM3nETPUY+GqMAwp:+/WoG2WU2srhBKVME+nETPUibp

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HostProcess = "C:\\Users\\Admin\\AppData\\Roaming\\HostProcess\\16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe"	16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe

C:\Users\Admin\AppData\Local\Temp\16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe
"C:\Users\Admin\AppData\Local\Temp\16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe"
1⤵
- Adds Run key to start application
PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1484-55-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1484-56-0x0000000000455000-0x0000000000466000-memory.dmp

Filesize
68KB

Download
memory/1484-57-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1484-58-0x0000000000455000-0x0000000000466000-memory.dmp

Filesize
68KB

Download