511db1f65525516f10cdb0255316d484b0e11c25b6bc5a6ebcf08a9b2f8c9a1d

Analysis

max time kernel
152s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02-08-2023 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

socks.exe
Size

8KB
MD5

d2c6bccf7c72af5d76d555c7272dded9
SHA1

2bb01b0a92c6546534e9745f69d16847569942bd
SHA256

511db1f65525516f10cdb0255316d484b0e11c25b6bc5a6ebcf08a9b2f8c9a1d
SHA512

ad237fd3bf1325502eb5cccadfb125c4795dd2363834c8cbe9b78c9e0abf1211e0105a82ab5d2fda17b07d428a16f8a2f88e360d51baa0a5e3a17a5bd5533b58
SSDEEP

96:viujWjxtYqRQ3ea4W/E/MM4odWLora0Fy/eKW9ZGcp2xFK+gEjaOoSM:KujWjlQOa4P/ZbdV6eKxFK+dHM

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

socks.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\socks.exe'\""	socks.exe

C:\Users\Admin\AppData\Local\Temp\socks.exe
"C:\Users\Admin\AppData\Local\Temp\socks.exe"
1⤵
- Adds Run key to start application
PID:2268

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads