6f46269af6d40baf7c001e3f1b1ceb468c716bceed00d3b3be7f481937ecccfc

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-es
resource tags

arch:x64arch:x86image:win7-20231129-eslocale:es-esos:windows7-x64systemwindows
submitted
21-05-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BSCO-REGISTER.exe
Size

16KB
MD5

bb0dc4696f96e89594e5d6f13ace24a1
SHA1

a2648940d71390ffe070134055484cf400df38e3
SHA256

6f46269af6d40baf7c001e3f1b1ceb468c716bceed00d3b3be7f481937ecccfc
SHA512

070ca1916f8ecf584ae271c26e612d6ae99c87a096b3837d180c0d5a77785920f7566a25717c3c8fffc2673539d2cb7023ff57cd92d36550862baea0938be636
SSDEEP

96:koVg6r1wCCbBarsanJtRHJeZW+RElJ869X/Q/YsA5SEnrtDINyncI+vL/mg56NMK:LVZZrDRgAKErkEnrtDINynT+vCgcNXf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

BSCO-REGISTER.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe"	BSCO-REGISTER.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BSCO-REGISTER.exe

pid process

1780 BSCO-REGISTER.exe

pid	process
1780	BSCO-REGISTER.exe

C:\Users\Admin\AppData\Local\Temp\BSCO-REGISTER.exe
"C:\Users\Admin\AppData\Local\Temp\BSCO-REGISTER.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads