77a164b6f3112876b7b2b2c8a7b9ee57997ddde6f4e6cd5235f41c1cd5478621

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab.exe
Size

239KB
MD5

8b1d78544683f817e6d557e5d52ffefd
SHA1

1087645986cac7f9153ba9a46cb9fa450c78497c
SHA256

8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab
SHA512

cdb670d399ca078e83acbb6a1d0663dd733b4516ac949f20ec963ff4f743505bb879c58a3f09ca94a9da3a45599733cfc6794793acab39fa58eb47ee4c7ee1b5
SSDEEP

3072:p8Fn3x+lIvPpe0vq9aqBJLxF2BhJA9ZDsjHmsW+lIvPpC5vq9aqBJLxFJ679Y:p8b153/CJLfihwsjGsW15a/CJLfm9

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChristmasPresent = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab.exe\""	8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab.exe

C:\Users\Admin\AppData\Local\Temp\8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab.exe
"C:\Users\Admin\AppData\Local\Temp\8b13ff52ff84eff160a5c0b8c80c7bd336e5bcfef7730ce7a5c499f112632bab.exe"
1⤵
- Adds Run key to start application
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2888-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-0-0x0000000000900000-0x0000000000940000-memory.dmp

Filesize
256KB

Download
memory/2888-2-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/2888-3-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-4-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads