682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2023 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c76e949a6b3bfb992ceb54c3be68f69.exe
Size

229KB
MD5

8c76e949a6b3bfb992ceb54c3be68f69
SHA1

32892363bea5d921144baac2017e4ca06ecf8269
SHA256

682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719
SHA512

2f949be9e7275067306338cd91331f21bc60bf4f0a1479b2953a199619d5a21f54d31031bf66c89662871eedd72d751f733c89cfefbb22a4fe6bbe06c1823ac8
SSDEEP

3072:Vlbprkr+kEzf417cGwQyd79mo3VCLtcnxS/s0bQc2poHFh:nbpQr+kwQ18hJzVW+n40poH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run	8c76e949a6b3bfb992ceb54c3be68f69.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\8c76e949a6b3bfb992ceb54c3be68f69.exe'\""	8c76e949a6b3bfb992ceb54c3be68f69.exe

C:\Users\Admin\AppData\Local\Temp\8c76e949a6b3bfb992ceb54c3be68f69.exe
"C:\Users\Admin\AppData\Local\Temp\8c76e949a6b3bfb992ceb54c3be68f69.exe"
1⤵
- Adds Run key to start application
PID:4388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4388-134-0x0000000000630000-0x0000000000634000-memory.dmp

Filesize
16KB

Download
memory/4388-135-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download