f102600bdc8a004ca6123196f7b5ad129db10f5cfc98a154aacc6aeac74f8c1b

Analysis

max time kernel
277s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f102600bdc8a004ca6123196f7b5ad129db10f5cfc98a154aacc6aeac74f8c1b.exe
Size

116KB
MD5

7c866ef3ac095edd0c4889fbd537f235
SHA1

a7c3e9e0e4522d05702f7dbb67005a90a687f31e
SHA256

f102600bdc8a004ca6123196f7b5ad129db10f5cfc98a154aacc6aeac74f8c1b
SHA512

5fb656288b3a599aa6e438599f11ab63436fb068a4c429642adc18b0df2667c8852f78e4f30094e3506d2aba53db98e7e20ebfd85393195dbc917f2e267d5944
SSDEEP

1536:5lJy0RUPpgm+86UjjFFIBTUJiLTjyOmPVrzbLfPzKqR9H:7Q0R4/bZFJiLT2PVrzbLfPzKG9H

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	f102600bdc8a004ca6123196f7b5ad129db10f5cfc98a154aacc6aeac74f8c1b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a2a0abbaadb6bbe1aab7aa = "C:\\Users\\Admin\\AppData\\Roaming\\ubyt.exe"	f102600bdc8a004ca6123196f7b5ad129db10f5cfc98a154aacc6aeac74f8c1b.exe

C:\Users\Admin\AppData\Local\Temp\f102600bdc8a004ca6123196f7b5ad129db10f5cfc98a154aacc6aeac74f8c1b.exe
"C:\Users\Admin\AppData\Local\Temp\f102600bdc8a004ca6123196f7b5ad129db10f5cfc98a154aacc6aeac74f8c1b.exe"
1⤵
- Adds Run key to start application
PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5056-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download