c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a

Analysis

max time kernel
44s
max time network
54s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a.exe
Size

204KB
MD5

b70286ce7a5859bd7e255f1efd7985c8
SHA1

03931babbdc5a4442361de76b55f60acc9d1318a
SHA256

c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a
SHA512

60a93be7a01104417360ca7cd0743c42e0b92b933789dd041d90af81a68cc7ba176797d1ba25f923d5e68aa49b496f907fc4d66ab7e33459cd633e7aab062d4b
SSDEEP

3072:PCJRerOyZ53UtamqFTjab40LhV4V42JB733Jhni7MBMt5xoTZ:PCeXz3UtamW/uZI4UJvio4xO

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\3Bsn9hQ6vHBDGDzWp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a.exe"	c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a.exe

C:\Users\Admin\AppData\Local\Temp\c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a.exe
"C:\Users\Admin\AppData\Local\Temp\c68d8d534838eaccbfb39b146a122e96a21759d2d87f1d81071b46bd274b185a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download