e986202e7bc24cdec280d58bb5d142c55f19566cd8f13ef543377eb337568988

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ae53903ccaba1bc3fd09c66d095ff92.exe
Size

165KB
MD5

7ae53903ccaba1bc3fd09c66d095ff92
SHA1

bd6bf53fd30613311801a24924f4ceedae2fe17b
SHA256

e986202e7bc24cdec280d58bb5d142c55f19566cd8f13ef543377eb337568988
SHA512

4b940870166a5ecb40cfdd6cf26397ce77d2cc00bd7d1353fd68af10002de09a87f505c89a31ebe6238e76f40b306d66e50ef9e296b61574b4b51f7bfec2736b
SSDEEP

3072:YBpB5GDAqF1OxdXiOnW/r8N1e0UGiF3WR5ER3IuUOPJ9fbhB:WzG8nriOnW/rGgGiF3WR9uBPJFhB

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	7ae53903ccaba1bc3fd09c66d095ff92.exe
File opened for modification	C:\Windows\system32\drivers\etc\hîsts	7ae53903ccaba1bc3fd09c66d095ff92.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\69\FreeGiftVk 3.969\Uninstall.exe	7ae53903ccaba1bc3fd09c66d095ff92.exe
File created	C:\Program Files (x86)\69\FreeGiftVk 3.969\Uninstall.ini	7ae53903ccaba1bc3fd09c66d095ff92.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7ae53903ccaba1bc3fd09c66d095ff92.exe
"C:\Users\Admin\AppData\Local\Temp\7ae53903ccaba1bc3fd09c66d095ff92.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download