b947d96fc1a2776113720715d52c81b5c624495631d88a0f024424475944ba2f

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bf185b27b3b5d5a7a243fab2ca1cc4b.exe
Size

196KB
MD5

7bf185b27b3b5d5a7a243fab2ca1cc4b
SHA1

698da41d96ac98a200c101689c95f5106211b604
SHA256

b947d96fc1a2776113720715d52c81b5c624495631d88a0f024424475944ba2f
SHA512

2ee96e1c174796df147469c89982b42ae3c2e9ee0e773c274f29a5f6adcb6314a03de69451be2de51ed76098fa0bb8d804683ea7175e44ebe3f2cc481534a776
SSDEEP

3072:3T3hFfhOCTHd/OkypTHK8ur7pD+hN/5WJuZxo6M9TV4cHu3dtbD:jPfhO8eTq3pyhNBWscTV4oyt

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7bf185b27b3b5d5a7a243fab2ca1cc4b = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7bf185b27b3b5d5a7a243fab2ca1cc4b.exe"	7bf185b27b3b5d5a7a243fab2ca1cc4b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7bf185b27b3b5d5a7a243fab2ca1cc4b = "C:\\Windows\\msng.exe"	7bf185b27b3b5d5a7a243fab2ca1cc4b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msng.exe	7bf185b27b3b5d5a7a243fab2ca1cc4b.exe
File created	C:\Windows\msng.exe	7bf185b27b3b5d5a7a243fab2ca1cc4b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7bf185b27b3b5d5a7a243fab2ca1cc4b.exe
"C:\Users\Admin\AppData\Local\Temp\7bf185b27b3b5d5a7a243fab2ca1cc4b.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-0-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1872-2-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1872-4-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads