0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5.exe
Size

984KB
MD5

62466b6f762925d4c268ca8fea8db1f0
SHA1

364c3e6442ebc77f2301ee3f465478228b8cede8
SHA256

0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5
SHA512

0d6cc904457c5cde99c1665d3872d0ffa1e269a752e2a5d7227d9bbce6e42d24fc21efcee65c021992295a2b564836094e5c53d8bc9d006ac14b42d2d4b96be5
SSDEEP

12288:N2ToLD2QfWUEknSsmjj/UVF4TmS9KvTjMVJK1P5aEL3nAyhxoeVs7:NkuPfWsnnw/UV+mS9K3MVcRab2vq

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i"	0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1728	0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5.exe

C:\Users\Admin\AppData\Local\Temp\0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5.exe
"C:\Users\Admin\AppData\Local\Temp\0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0df18d6676cca47f32bfade9cdb47515350673166ce4ae73e147f7484f3ce5a5.exe

Filesize
984KB

MD5
df6124bea5e134aa992652c90b5b00c4

SHA1
bc16eecfcb11036bf5a3fa17ac4fc546612f3ebc

SHA256
2263baa166a99bf0f0adcec32a18c3141cf59b6012d3e90a807788525e86551d

SHA512
f01032e38108512a907bc3dfc05f2889843e25aa18fede79b7d19e4d0f74f70f4c408bf4be1620a781774f1d357c0f51a24d4095c8b94965d97e0cea1fbd1c0b

Download Submit
memory/1728-13-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-15-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-3-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-10-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1728-9-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-11-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-4-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-12-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-14-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-2-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1728-16-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-17-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-18-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-19-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-20-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/1728-21-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads