f0dc0f22c8889fd1752455261d71fff12af20d1b422fa0c0346858a365c21f95 | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10/05/2023, 01:48

Sharing

Report Analysis Logs

General

Target

computer-open-admin-command-prompt.reg
Size

259B
MD5

6920520e8342e509701560787f476b9e
SHA1

ddd6167e911ae70a810fa25b36ef05f39f635841
SHA256

95bd8d6fb068c6e5c94968c86ea7ae60d75225423ccb1a0a8929133564b74266
SHA512

2f9560360b212cecfbcc4ea428812941aa7cf2448be833a01520d33f7ee9f81d4b5c8d3b2e6a6ffcf86ea616aefec7100b66986711bb75b66f5dd90df0249eac

Score

1^/10

Malware Config

Signatures

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas\command\ = "cmd.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas\ = "Open Command Prompt as Administrator"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1932	regedit.exe

C:\Windows\regedit.exe
regedit.exe "C:\Users\Admin\AppData\Local\Temp\computer-open-admin-command-prompt.reg"
1⤵
- Modifies registry class
- Runs .reg file with regedit
PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download