Registry Run Keys / Startup Folder
dttcodexgigas.5ac3e23c0c50b5cb8ca01b675b827995ada38e5b.exe
Windows Exe (x86-32)
Created 5 years ago
VMRay Threat Identifiers (9 rules, 3473 matches)
| Severity | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
5/5 | Antivirus | Malicious content was detected by heuristic scan | 2 | - | |
4/5 | User Data Modification | Renames user files | 1 | Ransomware | |
2/5 | Data Collection | Reads sensitive browser data | 1 | - | |
2/5 | System Modification | Changes the desktop wallpaper. | 1 | - | |
1/5 | Persistence | Installs system startup script or application | 1 | - | |
1/5 | System Modification | Modifies application directory | 3389 | - | |
1/5 | Discovery | Possibly does reconnaissance | 1 | - | |
1/5 | System Modification | Modifies operating system directory | 76 | - | |
1/5 | System Modification | Creates an unusually large number of files | 1 | - |
Screenshots
Monitored Processes
MITRE ATT&CK™ Matrix - Windows
ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Modify Registry
Credential Access
Credentials in Files
Discovery
File and Directory Discovery
Lateral Movement
Collection
Automated Collection
Data from Local System
Command and Control
Exfiltration
Impact
Data Encrypted for Impact
Defacement
Sample Information
| ID | #1234029 |
| MD5 | |
| SHA1 | |
| SHA256 | |
| SSDeep | |
| ImpHash | |
| Filename | dttcodexgigas.5ac3e23c0c50b5cb8ca01b675b827995ada38e5b.exe |
| File Size | 4569.50 KB |
| Sample Type | Windows Exe (x86-32) |
Analysis Information
| Creation Time | 2020-08-21 23:08 (UTC+) |
| Analysis Duration | 00:02:00 |
| Number of Monitored Processes | 1 |
| Execution Successful |  |
| Reputation Enabled | |
| WHOIS Enabled |  |
| Local AV Enabled | |
| Local AV Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| YARA Enabled | |
| YARA Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| Number of AV Matches | 3 |
| Number of YARA Matches | 0 |
| Termination Reason | All processes terminated |
