b47b51734617175f5eab696fab1e0456faa13fd0d1f382172ab8bb54406852e6

Analysis

max time kernel
188s
max time network
234s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

066f75caf1e5859093d1752ad49a01b8.exe
Size

60KB
MD5

066f75caf1e5859093d1752ad49a01b8
SHA1

d6802382e7b027e1a9226d571f8d0174acb34292
SHA256

b47b51734617175f5eab696fab1e0456faa13fd0d1f382172ab8bb54406852e6
SHA512

8f81710cd7233933ca8dcfd8aec11cba849345d7a8325921ac6c0b7d03cbbdbcc0b711d4fbd7a1bb25d929e9909599af7762a36abba55dec2dd919707064853c
SSDEEP

768:09IMNnp/+me5V441adRg4O/Mx3e7egRt6c/L9R7eunjc94DlhIWl5dMBwZa0XIfd:K/+E4cYL/m3e7egLD9RrI+dM2Za0XIf

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	066f75caf1e5859093d1752ad49a01b8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\7B6O4QXXGKPH.exe	066f75caf1e5859093d1752ad49a01b8.exe
File opened for modification	C:\Windows\7B6O4QXXGKPH.exe	066f75caf1e5859093d1752ad49a01b8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2280	066f75caf1e5859093d1752ad49a01b8.exe
2280	066f75caf1e5859093d1752ad49a01b8.exe
2280	066f75caf1e5859093d1752ad49a01b8.exe
2280	066f75caf1e5859093d1752ad49a01b8.exe
2280	066f75caf1e5859093d1752ad49a01b8.exe

C:\Users\Admin\AppData\Local\Temp\066f75caf1e5859093d1752ad49a01b8.exe
"C:\Users\Admin\AppData\Local\Temp\066f75caf1e5859093d1752ad49a01b8.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads