b4feaecdda147f766572f8b882c277852dcb94f1d76e2725d5a5f0a65d7517b8

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b2191e2e36ca7dd78b0eef5a44bedaa.exe
Size

257KB
MD5

1b2191e2e36ca7dd78b0eef5a44bedaa
SHA1

cf4ffaed00828c4eed0a4eb241e97f2a8942f350
SHA256

b4feaecdda147f766572f8b882c277852dcb94f1d76e2725d5a5f0a65d7517b8
SHA512

9df91a1ac91661782bcfe54eb0c226c6d5c8ac5b59d493c9e7b7f4646c5be7618d151b298f9cc2f5b1371ce0c103541da71f72364d99e29228f9aab8cc3c9bc5
SSDEEP

6144:VZbatLaPo//+mLbaHJY7YCyWkLWLCUYCA9GpoHZlZLCYOlkARji:PaF+M+mLA+7sWkLWLzpoLZLCJuAxi

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winsock.exe = "c:\\windows\\system32\\winsock.exe"	1b2191e2e36ca7dd78b0eef5a44bedaa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsock.exe = "c:\\windows\\system32\\winsock.exe"	1b2191e2e36ca7dd78b0eef5a44bedaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winsock.exe = "c:\\windows\\system32\\winsock.exe"	1b2191e2e36ca7dd78b0eef5a44bedaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\winsock.exe = "c:\\windows\\system32\\winsock.exe"	1b2191e2e36ca7dd78b0eef5a44bedaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServicesOnce\winsock.exe = "c:\\windows\\system32\\winsock.exe"	1b2191e2e36ca7dd78b0eef5a44bedaa.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\c:\autorun.inf	1b2191e2e36ca7dd78b0eef5a44bedaa.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\winsock.exe	1b2191e2e36ca7dd78b0eef5a44bedaa.exe
File opened for modification	\??\c:\windows\SysWOW64\winsock.exe	1b2191e2e36ca7dd78b0eef5a44bedaa.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system.ini	1b2191e2e36ca7dd78b0eef5a44bedaa.exe

C:\Users\Admin\AppData\Local\Temp\1b2191e2e36ca7dd78b0eef5a44bedaa.exe
"C:\Users\Admin\AppData\Local\Temp\1b2191e2e36ca7dd78b0eef5a44bedaa.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-0-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1368-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1368-7-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads