16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe.exe
Size

984KB
MD5

83f3a12aa0dd4847ced2a272cb7e8fd0
SHA1

6fb6cb4b80704a66c4850965f524bcf7849a463d
SHA256

16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe
SHA512

6a6432af27e537eb489ec982ed528d418c234b8e3fb28046933c21d3e4aae8682fd40d35427aed826803d081ee940c109bce6ddc120421596d1be608acc227c1
SSDEEP

12288:N2ToLD2QfWUEknSsmjj/UVF4T5Sny+EDZQTjMVJK1P5aEL36dyhxoeVs7:NkuPfWsnnw/UV+5Sny+EDKMVcRan2vq

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i"	16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1924	16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe.exe

C:\Users\Admin\AppData\Local\Temp\16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe.exe
"C:\Users\Admin\AppData\Local\Temp\16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4364,i,10426317566413639638,17907471819827662535,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\16f4cf31cfee3bf9ad5fb77f7bd4c03044c149a2dc9c55ab0e164f2c5bf8cbfe.exe

Filesize
984KB

MD5
c95349e67cd5651f8ae58798ecb59b3d

SHA1
1a45248464dbb66d0d5424d8164690674828d020

SHA256
f21c2b64f63defd763b50e7066c6007a1efb2c1df4a1fe5064481ff0e62d8d98

SHA512
0022a66bd02dd44db286d716b084c82f153d4c58f1dfbc0c32b6f267c6d5e4911db3049a0441df41f5cf839d05e4fbf8323c9b2bbe0575cf215c6662feef7141

Download Submit
memory/1924-13-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-15-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-3-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-10-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1924-9-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-11-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-4-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-12-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-14-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-2-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/1924-16-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-17-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-18-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-19-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-20-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1924-21-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads