1610b38f9e5c181f90f97fd53a19553a506fea85e2275db3402cfd771969feba

Analysis

max time kernel
157s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cac4acd2ac4cba226cfc612b007a6d0d.exe
Size

1.0MB
MD5

cac4acd2ac4cba226cfc612b007a6d0d
SHA1

2219af206c1034564f9b63430a25a1b4de6a41b4
SHA256

1610b38f9e5c181f90f97fd53a19553a506fea85e2275db3402cfd771969feba
SHA512

ff41a92843e02ad282a2874f256d261708a1fefa09342034b6d093bd571b3fffb1ea716d82d9be39d4d574717231a2ce3fe2c7ec922ac170dafc5b2c963c66b0
SSDEEP

24576:nncc+4S0L1P7T0Pw7F6AR58JLDRKE7AlOJ0KzMHxpr6+y:nncc+4S0L1P7gPBJLDRKE7AlOaKz8xp4

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i"	cac4acd2ac4cba226cfc612b007a6d0d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
228	cac4acd2ac4cba226cfc612b007a6d0d.exe

C:\Users\Admin\AppData\Local\Temp\cac4acd2ac4cba226cfc612b007a6d0d.exe
"C:\Users\Admin\AppData\Local\Temp\cac4acd2ac4cba226cfc612b007a6d0d.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2128 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cac4acd2ac4cba226cfc612b007a6d0d.exe

Filesize
1.0MB

MD5
26ea6696f8135c9f8af41a7230e501ac

SHA1
47d4ce3d87e3ef03305180ba5fb53e85685c0bec

SHA256
aa28ebdc3259fe9db59f9bd817e5b70d24a4d9d5ee3d649921ceaf57c7501d1b

SHA512
f7df5696fdf96d43a3010d158dd4f524dd980009bd03213fac3cd46e9a987a1dacecbb87254a60000f0c63949b06acaac0c0d4422a8b65192623d098eeee6b03

Download Submit
memory/228-13-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-2-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-14-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-6-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-15-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-11-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-12-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-16-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-5-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/228-4-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/228-17-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-18-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-19-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-20-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-21-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/228-22-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads