1cb25e102fceee8a8cb3c6474bb3db04fd7e26e21470a63f8d3ec7a84aa11468

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9535cba887d44f44d85ff629d8c7abf0N.exe
Size

984KB
MD5

9535cba887d44f44d85ff629d8c7abf0
SHA1

b7dd9e709803b30a7fddead977f6e77a146a5854
SHA256

1cb25e102fceee8a8cb3c6474bb3db04fd7e26e21470a63f8d3ec7a84aa11468
SHA512

24196c5465720694f5a801fef3acbf0130110d50137cd6cce3161235a08dc3235b6e6412e6eb106405d5392a58b168f0a3aaea0877684dea9f00826b8f3876e8
SSDEEP

12288:N2ToLD2QfWUEknSsmjj/UVF4TpSB6CRhi/HldTjMVJK1P5aEL3IhYyhxoeVs7:NkuPfWsnnw/UV+pSB6q0NhMVcRaE2vq

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i"	9535cba887d44f44d85ff629d8c7abf0N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2528	9535cba887d44f44d85ff629d8c7abf0N.exe

C:\Users\Admin\AppData\Local\Temp\9535cba887d44f44d85ff629d8c7abf0N.exe
"C:\Users\Admin\AppData\Local\Temp\9535cba887d44f44d85ff629d8c7abf0N.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9535cba887d44f44d85ff629d8c7abf0N.exe

Filesize
984KB

MD5
3f0a29a800febd95616697950a4403b0

SHA1
298f753e9ec606c0904a10a1a305bcb7234cbc61

SHA256
5ddfbfdeddf9dda5f5fd723412df6064c305a099a006fa783c18167dce61b8aa

SHA512
6675604ef1c5fd2f40c87333ab6eac0d125b73ef1fe0bb75f0e87ea7cb7d5f6565d61aaae172299e394d847d0b6b749eea7e5d9c6db2fd8f0793b414f74c2929

Download Submit
memory/2528-11-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-4-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-3-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-9-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-10-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-2-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2528-12-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-13-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-14-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-15-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-16-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2528-17-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads