16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe
Size

466KB
MD5

6238eeaa05142294a413acae26dbd839
SHA1

3933247936a98d86398a079ef970e5cf6c65605b
SHA256

16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338
SHA512

17343f3b36e3d85223dbb97fd498b87d862d12ec16781efda9424f5aaf87a0c3a5b561d40e67d11a7b593c120266404f6614781bb59c57322eaeeb0c63b4cd04
SSDEEP

6144:vw9/WoGEtW9jW2sgShXxrmVV2PEM3nETPUY+GqMAwp:+/WoG2WU2srhBKVME+nETPUibp

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HostProcess = "C:\\Users\\Admin\\AppData\\Roaming\\HostProcess\\16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe"	16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe

C:\Users\Admin\AppData\Local\Temp\16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe
"C:\Users\Admin\AppData\Local\Temp\16d8f9a459deac6ee71adefd2a619f87373bf348e5f74f60772e5367fc22a338.exe"
1⤵
- Adds Run key to start application
PID:4860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-132-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/4860-133-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/4860-134-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download