0f5d4dbbe5e55b7aa31b91e5925ed901fdf46a367491d81381846f05ad54c45e

General

Target

7z1900-x64.exe
Size

1.4MB
MD5

d7b20f933be6cdae41efbe75548eba5f
SHA1

9fa11a63b43f83980e0b48dc9ba2cb59d545a4e8
SHA256

0f5d4dbbe5e55b7aa31b91e5925ed901fdf46a367491d81381846f05ad54c45e
SHA512

af8f38679e16c996ffac152cac49369cf4b609abbd2cad07f49a114a82c6b5e564be29630c0fd2418110cf1a3d0ef3c9cc12f9164a69a575c91d9b98ce0df1a9

Score

10^/10

discovery persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 103 IoCs

Processes:

7z1900-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z1900-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z1900-x64.exe

Modifies registry class 20 IoCs

Processes:

7z1900-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z1900-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z1900-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z1900-x64.exe

C:\Users\Admin\AppData\Local\Temp\7z1900-x64.exe
"C:\Users\Admin\AppData\Local\Temp\7z1900-x64.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:2604

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads