9b14545ab9490a502ddbb7e51b3376a5b2a30509f52a612b1a4765d0a2ac6693

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e6c298d19c497c180a780d920ba342c.exe
Size

180KB
MD5

1e6c298d19c497c180a780d920ba342c
SHA1

727d722151e9a97cb2b65addbdf6e4ec813c329a
SHA256

9b14545ab9490a502ddbb7e51b3376a5b2a30509f52a612b1a4765d0a2ac6693
SHA512

507d97b69446ead3b7360b9afee624fd7bd58817287a1586b38f2223c7997ed4e54708b58e63ac7b9bc183ce18f9f93020acb9c6d541ec5dac65652d6654dae6
SSDEEP

3072:9D26WIXy9vxDLyVvr1QwlLIKQzgpAtJ1llrP8bUzW5FjbmMj6Qrxa1:9D26WIC9JcCwmKRCNrPf2Na

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\FILEM.SYS	1e6c298d19c497c180a780d920ba342c.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FILEMON\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\FILEM.SYS"	1e6c298d19c497c180a780d920ba342c.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1732	1e6c298d19c497c180a780d920ba342c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	1e6c298d19c497c180a780d920ba342c.exe
Token: SeLoadDriverPrivilege	1732	1e6c298d19c497c180a780d920ba342c.exe
Token: SeLoadDriverPrivilege	1732	1e6c298d19c497c180a780d920ba342c.exe

C:\Users\Admin\AppData\Local\Temp\1e6c298d19c497c180a780d920ba342c.exe
"C:\Users\Admin\AppData\Local\Temp\1e6c298d19c497c180a780d920ba342c.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads