6f46269af6d40baf7c001e3f1b1ceb468c716bceed00d3b3be7f481937ecccfc

Analysis

max time kernel
21s
max time network
17s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21-05-2024 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BSCO-REGISTER.exe
Size

16KB
MD5

bb0dc4696f96e89594e5d6f13ace24a1
SHA1

a2648940d71390ffe070134055484cf400df38e3
SHA256

6f46269af6d40baf7c001e3f1b1ceb468c716bceed00d3b3be7f481937ecccfc
SHA512

070ca1916f8ecf584ae271c26e612d6ae99c87a096b3837d180c0d5a77785920f7566a25717c3c8fffc2673539d2cb7023ff57cd92d36550862baea0938be636
SSDEEP

96:koVg6r1wCCbBarsanJtRHJeZW+RElJ869X/Q/YsA5SEnrtDINyncI+vL/mg56NMK:LVZZrDRgAKErkEnrtDINynT+vCgcNXf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

BSCO-REGISTER.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe"	BSCO-REGISTER.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

BSCO-REGISTER.exe

pid process

4400 BSCO-REGISTER.exe

pid	process
4400	BSCO-REGISTER.exe

C:\Users\Admin\AppData\Local\Temp\BSCO-REGISTER.exe
"C:\Users\Admin\AppData\Local\Temp\BSCO-REGISTER.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads