630c55103136e3b7740e2d5d5392d74d76e9fc8f189ef4510dd7140c6f21b6cc

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:11

Target

041ba5118ee9c919ab02a812eb24b59b.exe
Size

7KB
MD5

041ba5118ee9c919ab02a812eb24b59b
SHA1

3cf3fa2d642ee71fa1ca4d4d2f336e50d541397c
SHA256

630c55103136e3b7740e2d5d5392d74d76e9fc8f189ef4510dd7140c6f21b6cc
SHA512

d7df25b5db3dc91b5f75e4bb018b234b56a9ddf656d0822229501088231ca982552275056e6ec33a43f72e9408883703adb3a4a38cd39949b41bd4bf252ab5e5
SSDEEP

96:XfxSbKpS8cHwl44zu/R98PxV7gn6r82Brqvugg33bDrDkFoEuAlkYc5xpFMwBmsy:XgbKpEHwl6RyVsnMqxvixBBW7le

Score

8^/10

persistence

Modifies Installed Components in the registry 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3cfadea7-b472-09c7-09c7-c58367303c74}\StubPath = "C:\\Windows\\system32\\yji\\lsass.exe /t"	041ba5118ee9c919ab02a812eb24b59b.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3cfadea7-b472-09c7-09c7-c58367303c74}	041ba5118ee9c919ab02a812eb24b59b.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	041ba5118ee9c919ab02a812eb24b59b.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\yji\lsass.exe	041ba5118ee9c919ab02a812eb24b59b.exe
File opened for modification	C:\Windows\SysWOW64\yji\lsass.exe	041ba5118ee9c919ab02a812eb24b59b.exe