252c39dad5fa8f0f3add9e6b29ddc850c1791585bfcba50a68706a7ec464b5f1

Analysis

max time kernel
146s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

serwer.exe
Size

531KB
MD5

241f126a482976bb08e2ba5e2659b920
SHA1

307fda84fcd6efb8ea825f9abf5eb2be332d0ae8
SHA256

7443f9c791a878d45fda1d1588a58a70269e651cc21ba1f3743d1ed28d961b0a
SHA512

3f06b5c3011f5822c11cca2ededd4eea79fe6a826604550513fee9b9d6b64fa9ffb0cdb6b4cbd0705fea6ba32ad38868daba306b61889225232f790858b416cc
SSDEEP

12288:VA89XSbbKSCxtm6IirAVbWqlTrTO4yubwFXHrGx:VN9a6tm6troWqBrbEbi

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	serwer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windows\\winlogon.exe"	serwer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\plik.exe	serwer.exe
File opened for modification	C:\Windows\plik.exe	serwer.exe
File created	C:\Windows\winlogon.exe	serwer.exe
File opened for modification	C:\Windows\winlog.txt	serwer.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
880	serwer.exe
880	serwer.exe
880	serwer.exe
880	serwer.exe
880	serwer.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
880	serwer.exe
880	serwer.exe
880	serwer.exe
880	serwer.exe
880	serwer.exe

C:\Users\Admin\AppData\Local\Temp\serwer.exe
"C:\Users\Admin\AppData\Local\Temp\serwer.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download