Overview

overview

10

Static

static

7z1900-x64.exe

windows7_x64

10

7z1900-x64.exe

windows10_x64

10

Analysis

  • max time kernel
    119s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-01-2021 21:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7z1900-x64.exe

  • Size

    1.4MB

  • MD5

    d7b20f933be6cdae41efbe75548eba5f

  • SHA1

    9fa11a63b43f83980e0b48dc9ba2cb59d545a4e8

  • SHA256

    0f5d4dbbe5e55b7aa31b91e5925ed901fdf46a367491d81381846f05ad54c45e

  • SHA512

    af8f38679e16c996ffac152cac49369cf4b609abbd2cad07f49a114a82c6b5e564be29630c0fd2418110cf1a3d0ef3c9cc12f9164a69a575c91d9b98ce0df1a9

Score
10/10
discoverypersistence

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs
    persistence
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 103 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7z1900-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\7z1900-x64.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    PID:296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\7-Zip\7zFM.exe
    MD5

    c8f40f25f783a52262bdaedeb5555427

    SHA1

    e45e198607c8d7398745baa71780e3e7a2f6deca

    SHA256

    e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316

    SHA512

    f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191

    Download Submit
  • memory/296-2-0x0000000076381000-0x0000000076383000-memory.dmp
    Filesize

    8KB

    Download