814203d65954a779217651ab21cee6a9af7e64f552fa188e5894073e016a5cda

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fefd4124f795cd01bf817bcd4e44080N.exe
Size

28KB
MD5

2fefd4124f795cd01bf817bcd4e44080
SHA1

f2e0edf7c5e982dfe0982d856f7e3f8923633ba7
SHA256

814203d65954a779217651ab21cee6a9af7e64f552fa188e5894073e016a5cda
SHA512

3816db7753800b035f0b5420e4616e7e53fa5756aba7f585b83506b0d54e6f686e81859019be5821e28dbaaf575a6e34d1655d72208a5bb1c9ddb6261f086f24
SSDEEP

768:+ypFFSBXQtdcY4z7XxveMtSNYwQLao8WbX:JpFjdctz7Xxvvt8YZT8WbX

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\krsx\" %1 %*"	2fefd4124f795cd01bf817bcd4e44080N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2fefd4124f795cd01bf817bcd4e44080N.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\krsx.txt	2fefd4124f795cd01bf817bcd4e44080N.exe
File created	C:\Windows\krsx.exe	2fefd4124f795cd01bf817bcd4e44080N.exe
File opened for modification	C:\Windows\krsx.exe	2fefd4124f795cd01bf817bcd4e44080N.exe
File opened for modification	C:\Windows\krsxkrsx.dll	2fefd4124f795cd01bf817bcd4e44080N.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2fefd4124f795cd01bf817bcd4e44080N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\krsx\" %1 %*"	2fefd4124f795cd01bf817bcd4e44080N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1148	2fefd4124f795cd01bf817bcd4e44080N.exe
1148	2fefd4124f795cd01bf817bcd4e44080N.exe

C:\Users\Admin\AppData\Local\Temp\2fefd4124f795cd01bf817bcd4e44080N.exe
"C:\Users\Admin\AppData\Local\Temp\2fefd4124f795cd01bf817bcd4e44080N.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-12-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-14-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-15-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-17-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1148-18-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download