682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719

Resubmissions

16-06-2023 13:14

230616-qgsyzafb38 6

16-06-2023 04:47

230616-femn3acf5v 6

Analysis

max time kernel
1800s
max time network
1772s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-06-2023 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719.exe
Size

229KB
MD5

8c76e949a6b3bfb992ceb54c3be68f69
SHA1

32892363bea5d921144baac2017e4ca06ecf8269
SHA256

682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719
SHA512

2f949be9e7275067306338cd91331f21bc60bf4f0a1479b2953a199619d5a21f54d31031bf66c89662871eedd72d751f733c89cfefbb22a4fe6bbe06c1823ac8
SSDEEP

3072:Vlbprkr+kEzf417cGwQyd79mo3VCLtcnxS/s0bQc2poHFh:nbpQr+kwQ18hJzVW+n40poH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run	682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719.exe'\""	682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719.exe

C:\Users\Admin\AppData\Local\Temp\682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719.exe
"C:\Users\Admin\AppData\Local\Temp\682dc9f1350f3cfab2740e249fc00639927e0a53e8598e07611425dad2821719.exe"
1⤵
- Adds Run key to start application
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-55-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1996-56-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download