949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3

Analysis

max time kernel
142s
max time network
132s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27/03/2023, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3.exe
Size

186KB
MD5

04c42bb46b0698e251a41cdf93957755
SHA1

ed197bddfbb5c65066f1e7dc9c2b598ebdd571f3
SHA256

949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3
SHA512

7f69292d45cc80aef54a4f25e1066dfe29a6ffee870cd96271071b6048eb983e4cd426d82bb75cc97973d6c0c48f46f1aa299c29bf9ce19fa01e0215223ba437
SSDEEP

1536:q/xKiyRiIRGFx9kbyN+GljVIm7pGALlHV1:BiyHGFAb98X911

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Amazon Music Starter = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3.exe\""	949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1604	949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3.exe

C:\Users\Admin\AppData\Local\Temp\949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3.exe
"C:\Users\Admin\AppData\Local\Temp\949ada32da5613c136eb7107140afe5b78fd3f288eadcb70d7741004e68870d3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-54-0x0000000000EB0000-0x0000000000EE4000-memory.dmp

Filesize
208KB

Download
memory/1604-55-0x000000001B4D0000-0x000000001B550000-memory.dmp

Filesize
512KB

Download
memory/1604-56-0x000000001B4D0000-0x000000001B550000-memory.dmp

Filesize
512KB

Download