Overview

overview

10

Static

static

3

1b04fed56c...fb.exe

windows7-x64

10

1b04fed56c...fb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 14:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1b04fed56cc05affc0fd0714c2a666fb.exe

  • Size

    82KB

  • MD5

    1b04fed56cc05affc0fd0714c2a666fb

  • SHA1

    488e70953f09b8bc0a3126369111f7bb518b85c1

  • SHA256

    f4ed5873aa59da6bc14f2a88383ed7a6df95f875d9722a3984e79a6b26534156

  • SHA512

    1153cd907436ed7f434447b50bc6705c8dfc29d4fc903235304d1b22f5974017522ec91d4b240614a02b1b34b67a5f2c29a90d1693712bd55d2299c36da74726

  • SSDEEP

    1536:gNn73uD3Bzpm/HCqB9m89Xlui5sDUc/8cpqL4oFelvFMRe3WPTUZjEUJw:gNn73SBzQ6qDBluC6/klyaRe3OTqEUJw

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b04fed56cc05affc0fd0714c2a666fb.exe
    "C:\Users\Admin\AppData\Local\Temp\1b04fed56cc05affc0fd0714c2a666fb.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2452

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Microsoft Common Items.com
          Filesize

          84KB

          MD5

          2169519f273321087f0985564c30c69e

          SHA1

          183479cc6c88aff95c35f1668073ba1249f724d9

          SHA256

          0c9857b805ea8432b79a398ab88712c1d6ae70142876f2c67e99585151f7f2b8

          SHA512

          38edb1d031c0715c0d1cc9a9784bd61985b16dea4f911c63e771bc540d697a519dced88ef4a3e4951019489cc487fbaa3eefe5713f4a984702df4910c7565273

          Download Submit

        • memory/2452-21-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

          Download

        • memory/2452-32-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

          Download