f04c4e8c4ba107785b9029e4af832679d7f5d1c1a902c2fad1a018d7c76b40bb

Analysis

max time kernel
208s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f04c4e8c4ba107785b9029e4af832679d7f5d1c1a902c2fad1a018d7c76b40bb.exe
Size

124KB
MD5

9c89ee46873c5e5baeb6239067ae689d
SHA1

8056bfacdb14774f71a375420087d33d862e6f77
SHA256

f04c4e8c4ba107785b9029e4af832679d7f5d1c1a902c2fad1a018d7c76b40bb
SHA512

1a484355289a45ab7a6d6bfec94970c12b77ea514ac14949940a87f0d7069c36f1fc1454f0b0b787eb4d2d8fbf40e299fda54d8abbe349f23d3c265cab8742a0
SSDEEP

1536:orSUgeHWGsZez67kAUYph7a1IeZzSh42ltU1T7SN44eJ7guqq7zsDdzAzf5g/B:orUeHNd62Yfa1TD24Njqq7z0Azf5g/B

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	f04c4e8c4ba107785b9029e4af832679d7f5d1c1a902c2fad1a018d7c76b40bb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\484851575945570d465b46 = "C:\\Users\\Admin\\AppData\\Roaming\\tzft.exe"	f04c4e8c4ba107785b9029e4af832679d7f5d1c1a902c2fad1a018d7c76b40bb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f04c4e8c4ba107785b9029e4af832679d7f5d1c1a902c2fad1a018d7c76b40bb.exe
"C:\Users\Admin\AppData\Local\Temp\f04c4e8c4ba107785b9029e4af832679d7f5d1c1a902c2fad1a018d7c76b40bb.exe"
1⤵
- Adds Run key to start application
PID:4220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads