d488f318023bd5b6bdf000d594ede4990a3db86a87708af3eac892d5ee40ce42

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6356147fb0d6a6988ae827326ce0dddc.exe
Size

572KB
MD5

6356147fb0d6a6988ae827326ce0dddc
SHA1

cdc2bbfa6e9b3e40759e86b51016aae279429852
SHA256

d488f318023bd5b6bdf000d594ede4990a3db86a87708af3eac892d5ee40ce42
SHA512

89c3f934fc7e7b32e0ced9f4f7a90326776d981a665e01f4410fab900a798342e87ae5db1543f6221a76deb6bb4fd06b0dbd8bf1808ea9b3683bc161d2671c53
SSDEEP

12288:wPfbMrOswqY+bJCAbzcoO+LQQg6nhYXsJm/DxN4I/DX/:DOsLYmJdJOAg6nh3mE

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\star6 = "C:\\WINDOWS\\system32\\MscheldB.exe"	6356147fb0d6a6988ae827326ce0dddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\star7 = "C:\\WINDOWS\\system32\\Mscheldncx.exe"	6356147fb0d6a6988ae827326ce0dddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\star8 = "C:\\WINDOWS\\system32\\svscheld.exe"	6356147fb0d6a6988ae827326ce0dddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gbpvs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6356147fb0d6a6988ae827326ce0dddc.exe"	6356147fb0d6a6988ae827326ce0dddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\star1 = "C:\\WINDOWS\\system32\\Winrun.exe"	6356147fb0d6a6988ae827326ce0dddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\star2 = "C:\\WINDOWS\\system32\\ischot.exe"	6356147fb0d6a6988ae827326ce0dddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\star3 = "C:\\WINDOWS\\system32\\Xred1.exe"	6356147fb0d6a6988ae827326ce0dddc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\star4 = "C:\\WINDOWS\\system32\\Zred2.exe"	6356147fb0d6a6988ae827326ce0dddc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\control.ctr	6356147fb0d6a6988ae827326ce0dddc.exe
File created	C:\windows\Longosm	6356147fb0d6a6988ae827326ce0dddc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	6356147fb0d6a6988ae827326ce0dddc.exe

C:\Users\Admin\AppData\Local\Temp\6356147fb0d6a6988ae827326ce0dddc.exe
"C:\Users\Admin\AppData\Local\Temp\6356147fb0d6a6988ae827326ce0dddc.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-0-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/2032-1-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/2032-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2032-4-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/2032-6-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2032-7-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads