0415903698d96b3bb1dee99f5e9129f568f2bc78d4d4de3e56f0b63d48a7c9b4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

documenty.exe
Size

105KB
MD5

e5e24f842d98d69db8014af7b6c16f3b
SHA1

277ef6e1924dce13fa6639a52b03469d844e3e39
SHA256

68209ac273c90af01abba713b2dc94f9e6403035f27a0a2a76733a15fc5b989d
SHA512

f8a37f3aa3fad5150fb58b9dd42bbc27329d50c9b500d79507338d8b89cf5d183be8e33c62b88a591f28949fa5a407297b1b1a8eedfdac66297a72d7ea75a0a0
SSDEEP

1536:GbsTyvx4H6/GHUx4HbArSvJZPCHXJZkBaM3qQrnEDv:GH7/GHd75vGjoaM3qQrnEb

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\KasperskyLab	documenty.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	documenty.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2236	documenty.exe
2236	documenty.exe
2236	documenty.exe

C:\Users\Admin\AppData\Local\Temp\documenty.exe
"C:\Users\Admin\AppData\Local\Temp\documenty.exe"
1⤵
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/2236-1-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2236-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2236-3-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/2236-4-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download