1cb25e102fceee8a8cb3c6474bb3db04fd7e26e21470a63f8d3ec7a84aa11468

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9535cba887d44f44d85ff629d8c7abf0N.exe
Size

984KB
MD5

9535cba887d44f44d85ff629d8c7abf0
SHA1

b7dd9e709803b30a7fddead977f6e77a146a5854
SHA256

1cb25e102fceee8a8cb3c6474bb3db04fd7e26e21470a63f8d3ec7a84aa11468
SHA512

24196c5465720694f5a801fef3acbf0130110d50137cd6cce3161235a08dc3235b6e6412e6eb106405d5392a58b168f0a3aaea0877684dea9f00826b8f3876e8
SSDEEP

12288:N2ToLD2QfWUEknSsmjj/UVF4TpSB6CRhi/HldTjMVJK1P5aEL3IhYyhxoeVs7:NkuPfWsnnw/UV+pSB6q0NhMVcRaE2vq

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSNCore = "C:\\Users\\Admin\\AppData\\Local\\upNext.exe --i"	9535cba887d44f44d85ff629d8c7abf0N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2608	9535cba887d44f44d85ff629d8c7abf0N.exe

C:\Users\Admin\AppData\Local\Temp\9535cba887d44f44d85ff629d8c7abf0N.exe
"C:\Users\Admin\AppData\Local\Temp\9535cba887d44f44d85ff629d8c7abf0N.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9535cba887d44f44d85ff629d8c7abf0N.exe

Filesize
984KB

MD5
ae2ff849be9ec92238fb53286c6c49e3

SHA1
027f65e1af346b5c9e04b747bfdd52d25efff7ab

SHA256
0f0e81e6956dbc60878abfb522de4ee9262f758e5d44c2367cff43df9aa6b9f6

SHA512
c57830df2b1db7f3605ef9fb6ac6a0d837e1ae0725e77e278ba9fc87bcf145848f57da225fe0ec5582694ce637fb0fdb84a076ab8ab7f0aef436a3b89579634d

Download Submit
memory/2608-11-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-4-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-3-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-9-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-10-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-2-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2608-12-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-13-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-14-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-15-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-16-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download
memory/2608-17-0x0000000000040000-0x0000000000139000-memory.dmp

Filesize
996KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads