315bd0787840da3578101f8fd11166479d2e8493324258bdef1ec194811b72da

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6531fab93f88fe9ffe3e530485ed2d8b.exe
Size

347KB
MD5

6531fab93f88fe9ffe3e530485ed2d8b
SHA1

f50c9125d437ea8824582c562761496810a52581
SHA256

315bd0787840da3578101f8fd11166479d2e8493324258bdef1ec194811b72da
SHA512

89624f051ef31360b0c6332230e3574f08a4103a892aa206b2c67be24c1a4b74baa4b3052777181781d3c2e37d2daea43e0218322bbdce3cdf3075c3ddb6b3bc
SSDEEP

6144:u1s0d02fdZZZU2ako7W4d1AHeOb4Ts8x7hxauba/tiE4V+PNUre8ZX:uW0d02fd5U2akt4d1Abb4Q8DYbliE4w0

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\locxbod[jln[kn[nl[kn	6531fab93f88fe9ffe3e530485ed2d8b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Parametr = "C:\\FilesQQ\\xoptiloc[jln[kn[nl[kn"	6531fab93f88fe9ffe3e530485ed2d8b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Parametr = "C:\\GalaxRO\\dobdevsys[jln[kn[nl[kn"	6531fab93f88fe9ffe3e530485ed2d8b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1064	6531fab93f88fe9ffe3e530485ed2d8b.exe
1064	6531fab93f88fe9ffe3e530485ed2d8b.exe

C:\Users\Admin\AppData\Local\Temp\6531fab93f88fe9ffe3e530485ed2d8b.exe
"C:\Users\Admin\AppData\Local\Temp\6531fab93f88fe9ffe3e530485ed2d8b.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads