ae717f123bdaccc1f01a5cdae55a23c5adedc801f7a09744773fadbdcdd5782d

General

Target

94b4e98c8a91be86990520279cf53cf0.exe
Size

216KB
MD5

94b4e98c8a91be86990520279cf53cf0
SHA1

91311b302db89469368dd815c414c1296c357df0
SHA256

ae717f123bdaccc1f01a5cdae55a23c5adedc801f7a09744773fadbdcdd5782d
SHA512

d8390acae47c49879d982e1690605f2d92e8b338c6ae1d80214341b21907ebd34193f4cf5e08f312a4c1ba11eada610134850531ef2799235315a1ab4b6ace2b
SSDEEP

6144:/N743icSOzAfxV4e45mL9/raaggNqkzq:54ScSOz2xV4eK89rajHkO

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

94b4e98c8a91be86990520279cf53cf0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\KeApplet = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\{21B75C54-C69F-4584-81EB-642D294DDA3B}\\renovator.exe"	94b4e98c8a91be86990520279cf53cf0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\KeApplet = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\{21B75C54-C69F-4584-81EB-642D294DDA3B}\\renovator.exe"	94b4e98c8a91be86990520279cf53cf0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

94b4e98c8a91be86990520279cf53cf0.exe

pid	process
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe
3012	94b4e98c8a91be86990520279cf53cf0.exe

C:\Users\Admin\AppData\Local\Temp\94b4e98c8a91be86990520279cf53cf0.exe
"C:\Users\Admin\AppData\Local\Temp\94b4e98c8a91be86990520279cf53cf0.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~cl4A49.tmp

Filesize
1000B

MD5
8a7e2c7014c02137dad44e6b890764ec

SHA1
364f5da5471774f91ea67bc11ddaf01ab3f7c2f4

SHA256
918a41eab519a20f6070d8eb5f90fcce1f6ffaf06150d70ebb34aaafe8974ed7

SHA512
a14c40276dee7026bbbf7d0beb1e98b71bec6720ee2c453aeb25b0d89e9716840538fde4c65ca2b7322500f825b54c8df8032a285a7aee8302bf8c89529c4262

Download Submit
memory/3012-0-0x0000000000250000-0x00000000002C0000-memory.dmp

Filesize
448KB

Download
memory/3012-1-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/3012-16-0x00000000003B0000-0x00000000003D4000-memory.dmp

Filesize
144KB

Download
memory/3012-26-0x0000000000320000-0x000000000032D000-memory.dmp

Filesize
52KB

Download
memory/3012-35-0x0000000000320000-0x000000000032D000-memory.dmp

Filesize
52KB

Download
memory/3012-39-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads