68094f1f646fd9f29b71bf4989adfdc19dba465f2d31ce4aeb29abce483e0077

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

727323bcc3aa7ebb0634189e69491d47_JC.exe
Size

889KB
MD5

727323bcc3aa7ebb0634189e69491d47
SHA1

4e0a02f92ecf9ab36941835759a6c8ac40ec79f7
SHA256

68094f1f646fd9f29b71bf4989adfdc19dba465f2d31ce4aeb29abce483e0077
SHA512

b412cd9c0e42bf7e1080a3269e26457e3fc9194ea7754d27ff95a1d734980f17d88576ee7cbf5e6b8dc0a561dc88ee0b847d02f72eaf79ba7f083215e2c56e13
SSDEEP

3072:MGjhaq5iL0beJQZt32wLji5DlsODxRPNDkjJHzW9hUd56JsuBSjw75W6vfH2i1wB:Hha8iAx+1zwjJHd6vB/75W6XmVh3

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinSevenUpdater = "C:\\Windows\\system32\\AVSCANNER.EXE"	727323bcc3aa7ebb0634189e69491d47_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GGAAAG_LOADER = "C:\\Windows\\system32\\GAAG.exe"	727323bcc3aa7ebb0634189e69491d47_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FifefoxUpdater = "C:\\Windows\\system32\\FifefoxUpdater.scr"	727323bcc3aa7ebb0634189e69491d47_JC.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FifefoxUpdater.scr	727323bcc3aa7ebb0634189e69491d47_JC.exe
File created	C:\Windows\SysWOW64\AVSCANNER.EXE	727323bcc3aa7ebb0634189e69491d47_JC.exe
File opened for modification	C:\Windows\SysWOW64\AVSCANNER.EXE	727323bcc3aa7ebb0634189e69491d47_JC.exe
File created	C:\Windows\SysWOW64\GAAG.exe	727323bcc3aa7ebb0634189e69491d47_JC.exe
File opened for modification	C:\Windows\SysWOW64\GAAG.exe	727323bcc3aa7ebb0634189e69491d47_JC.exe
File created	C:\Windows\SysWOW64\FifefoxUpdater.scr	727323bcc3aa7ebb0634189e69491d47_JC.exe

C:\Users\Admin\AppData\Local\Temp\727323bcc3aa7ebb0634189e69491d47_JC.exe
"C:\Users\Admin\AppData\Local\Temp\727323bcc3aa7ebb0634189e69491d47_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\AVSCANNER.EXE

Filesize
899KB

MD5
74b6505a10c7d5143e8ec8ff8a4c2528

SHA1
2bb6ff7fbecc74e65eca719d4cf47d04e4e27811

SHA256
0f601bcf0eb49e3e1d1a9005e60c3f967d1ce62b0a6756925c05a736e2f87a2b

SHA512
18d127175afb4c9551369dbbc3ccc9839398141fd80a5196596d950033e8a95ca181868b59358431f5e2d02eaf215d93927b9def3cbb34fc67c7f9314c8bbd35

Download Submit
memory/2576-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads