8632ada0056f38a71d40fbbecfc1446dbd75f912a05a09ccb0205d0130c95cd1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48a10a0f1e817a0625bb47c9dadb81f7.exe
Size

229KB
MD5

48a10a0f1e817a0625bb47c9dadb81f7
SHA1

896864cb4e9777a294e0bf0e13d69be2bdb022eb
SHA256

8632ada0056f38a71d40fbbecfc1446dbd75f912a05a09ccb0205d0130c95cd1
SHA512

8415a12b8210e7ee4e2f7623e728db4280a0f40bd2f1f9baa9f66cb83f87a2c921574d796b4b5803b5426aeb1e88fd6854b5375e773299b0bf274315f6ea7456
SSDEEP

6144:IdrgmKGpAtqU4XI6CS8uwqRhubwYF2WIZY:Ia8ivWlrwehucYFh

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\netw = "C:\\Windows\\svw.exe"	48a10a0f1e817a0625bb47c9dadb81f7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svw.exe	48a10a0f1e817a0625bb47c9dadb81f7.exe
File opened for modification	C:\Windows\svw.exe	48a10a0f1e817a0625bb47c9dadb81f7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2352	48a10a0f1e817a0625bb47c9dadb81f7.exe
2352	48a10a0f1e817a0625bb47c9dadb81f7.exe

C:\Users\Admin\AppData\Local\Temp\48a10a0f1e817a0625bb47c9dadb81f7.exe
"C:\Users\Admin\AppData\Local\Temp\48a10a0f1e817a0625bb47c9dadb81f7.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x00000000002C0000-0x00000000002F8000-memory.dmp

Filesize
224KB

Download
memory/2352-1-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2352-2-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/2352-4-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads