79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6

Analysis

max time kernel
150s
max time network
65s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe
Size

588KB
MD5

c1ba27a91e221a36edfcd03f5d4b8579
SHA1

172bc5209bd547b602fc386efb926314fc16a41f
SHA256

79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6
SHA512

f3b586369d9ab3d21e833dbd9fd98f6fd3e34fa9707a8309658c630ae956ca5caf47419a3a7aae14562609b4563cf8e3a677332f55ca5442c728aabd56baa6fb
SSDEEP

12288:JrdlXbE2Gd+jUla7J9CIKTEQYwYOaVU9PeUcJwacRGG:Xq/0j97bYAAaVU9PeUBackG

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\services.exe = "\"C:\\Windows\\system32\\servicess.exe\""	79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\win.sys	79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe
File created	C:\Windows\SysWOW64\servicess.exe	79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe
File opened for modification	C:\Windows\SysWOW64\servicess.exe	79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1128	79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe

C:\Users\Admin\AppData\Local\Temp\79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe
"C:\Users\Admin\AppData\Local\Temp\79e89bbfb4d63b9755003e13627aecf96a5ad26d1c2ad2bd323759c3b64bdad6.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...