cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe
Size

185KB
MD5

4f0c0fcb9e122b317ab83b6745facb20
SHA1

dbc90ac04eb48db254d42d00cf76cec75390bb70
SHA256

cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679
SHA512

d98818dd262b7bb903b186dcb9b2de5f0001b208fd1f884aad99966f182e6f871a0604af11a5edfd93354bfd257fed89892bcfdedba6fdd736390557020d6782
SSDEEP

3072:UPn926P8TYMDnquKIwvHF5/gNNjz09mEhel648QERoH:U/9X00keIwP4N1IkE0l645o

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe = "C:\\Windows\\system32\\cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe"	cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe	cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe
File opened for modification	C:\Windows\SysWOW64\cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe	cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe
File created	C:\Windows\SysWOW64\iexplore.dll	cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe
File created	C:\Windows\SysWOW64\explorer.dll	cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1832	cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1384	1832	cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1384
- C:\Users\Admin\AppData\Local\Temp\cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe
  "C:\Users\Admin\AppData\Local\Temp\cabe33f81c805d75412d505cf8255078e85501ba3e12b307207e573706094679.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads