e20f36d3858a3b97d158e0dd9759c5f936f98facbb69a360a426a85b09f72639

Resubmissions

22-04-2024 07:30

240422-jb41qaha7v 6

22-04-2024 07:30

22-04-2024 07:30

22-04-2024 07:30

22-04-2024 07:30

22-04-2024 07:30

13-01-2024 02:49

Analysis

max time kernel
1799s
max time network
1801s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-04-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57c8e3604a2bea4c6bb18074ff5ab9bb.exe
Size

116KB
MD5

57c8e3604a2bea4c6bb18074ff5ab9bb
SHA1

f3ae798cd6ef8b2124031baf765a3a1c14c1723b
SHA256

e20f36d3858a3b97d158e0dd9759c5f936f98facbb69a360a426a85b09f72639
SHA512

61c9021a317f8051ced33c4cc4ae9e1cc8979d0b0887287f47a4083ebeec041804a070115a61d2eff5f97364557f2ea1674d3e4f2b526f5bbd3891f268a69d7d
SSDEEP

1536:Rc+gjdZzGB9bQNMeHq5ixZGLgyBmK8zccAy5mE1biojuIaWPhIgzVkQGDax2N:RcPdZ+JsaVBzQh/9hxs

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\oporf57ioe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\57c8e3604a2bea4c6bb18074ff5ab9bb.exe"	57c8e3604a2bea4c6bb18074ff5ab9bb.exe

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

C:\Users\Admin\AppData\Local\Temp\57c8e3604a2bea4c6bb18074ff5ab9bb.exe
"C:\Users\Admin\AppData\Local\Temp\57c8e3604a2bea4c6bb18074ff5ab9bb.exe"
1⤵
- Adds Run key to start application
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cached-consensus

Filesize
2.9MB

MD5
366d1d6b164fd9bb646302b5123490b4

SHA1
f59f947967ae928b3b214128a674a8d8e1b18e99

SHA256
74fe2c066c4e3defb21ac16b2f5bcf671a943c99c44848cc3f485da878b89f16

SHA512
9438f5bde84f4f0fa0c509d6a97673b7a2fa1a171466b956611ed54c3e08d1fdd206048d34d18f8980de5d2a57fed560f6cdf74fb9993cc62bfe68dcdfe926e0

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads