cc4960939a41d6a281ddad307b107e16214f4aeda261c9b5037f26e60dc7bba2

Analysis

max time kernel
121s
max time network
245s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VmManagedSetup.exe
Size

16KB
MD5

7ee103ee99b95c07cc4a024e4d0fdc03
SHA1

885fc76ba1261a1dcce87f183a2385b2b99afd96
SHA256

cc4960939a41d6a281ddad307b107e16214f4aeda261c9b5037f26e60dc7bba2
SHA512

ad3189d8ba4be578b13b81d50d1bd361f30fc001ebe27d365483858b3d78db38b6b54c1464f816b589c01407674ffcaae96d34b923ec15d0808cfed2bfa8ce21
SSDEEP

384:TWqH7LUQNe0YeoH9R7rkJApmiiT7AemssVnQgJmd:TW6LUQNeresznN8MsCntM

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

VmManagedSetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\VmManagedSetup.exe'\""	VmManagedSetup.exe

C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VmManagedSetup.exe"
1⤵
- Adds Run key to start application
PID:2528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads