8fad80147facb68f4d8982b1cf19808054373d8b3a60380f134c0d05afe33a11

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fad80147facb68f4d8982b1cf19808054373d8b3a60380f134c0d05afe33a11.exe
Size

96KB
MD5

4714e85c2de73e403d2b437e2fbef312
SHA1

94001ca0d23b1f7e28a55f1ac9e7d0622bce236a
SHA256

8fad80147facb68f4d8982b1cf19808054373d8b3a60380f134c0d05afe33a11
SHA512

37c49dfa57fa76894929e9694a4f6332b78d2fd749e8d78df72baa04f2799e2f54b36fa91c9c682969f982a2722cd8e5cf76d9dd79499588a9c12571d327a7e5
SSDEEP

1536:1mfhOBHeBFPbzN7F2sL1tI9NcmETO5A2oTM9GLD9f+s:1FeBFPV79HI9uxTmGLD92s

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\BITS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8fad80147facb68f4d8982b1cf19808054373d8b3a60380f134c0d05afe33a11.exe"	8fad80147facb68f4d8982b1cf19808054373d8b3a60380f134c0d05afe33a11.exe

C:\Users\Admin\AppData\Local\Temp\8fad80147facb68f4d8982b1cf19808054373d8b3a60380f134c0d05afe33a11.exe
"C:\Users\Admin\AppData\Local\Temp\8fad80147facb68f4d8982b1cf19808054373d8b3a60380f134c0d05afe33a11.exe"
1⤵
- Adds Run key to start application
PID:1848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download