8f68bacc1bb12d843865e89411dbd5d668e24b1720da8f44d735783ea1879887

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1b8f3b780aed6c5bd37c9e683597bf20.exe
Size

79KB
MD5

1b8f3b780aed6c5bd37c9e683597bf20
SHA1

9767d4e4ac9cda0bc10d72d87c338efc6eefffa1
SHA256

8f68bacc1bb12d843865e89411dbd5d668e24b1720da8f44d735783ea1879887
SHA512

809469062517df3738e327ea99d5c4b96e71dd3d290973388324ca49de0dd55ae5c5a39c619c46557f40dac60c05ac221a5471bd331a764af90f903e84b4c771
SSDEEP

1536:rzRoKwgjPtiKQod7Giz7uY0xC+gegAvKcykDXn3rlTqBmEh:nRorUPti1u7DPX0I3maKX5TqEEh

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2832	1b8f3b780aed6c5bd37c9e683597bf20.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\aplib.dll	1b8f3b780aed6c5bd37c9e683597bf20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2832	1b8f3b780aed6c5bd37c9e683597bf20.exe

C:\Users\Admin\AppData\Local\Temp\1b8f3b780aed6c5bd37c9e683597bf20.exe
"C:\Users\Admin\AppData\Local\Temp\1b8f3b780aed6c5bd37c9e683597bf20.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\aplib.dll

Filesize
12KB

MD5
35d174edd3c0bcfa9a32dce19e1abeb9

SHA1
c22638e64f8a5f34809811a2c286ae2f115028f8

SHA256
34194aa58d0eb70b513ea6a876a4f35ba6cc2f19c4fb6d408dd05580dcc74b04

SHA512
f807df3655e6dd0cea2412ae82aa7b3babe3862fa9eee5d38673ee30b26a528b9618e1a25d3a58ef1ff14be36a666fabd32968b5f4dc481539d2372b526c1ead

Download Submit