7d5e3dd5ce6195906cdf9254d422b394930ff7b5ddb25fb0e9d0862be7780dd5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cc577a6e0f4c948432661592f8e55bd.exe
Size

28KB
MD5

3cc577a6e0f4c948432661592f8e55bd
SHA1

48aa64f58e2e9145c975d6e6339609d14f69bac1
SHA256

7d5e3dd5ce6195906cdf9254d422b394930ff7b5ddb25fb0e9d0862be7780dd5
SHA512

8a050a9ff58adb5a1c8907c2122665e0c566b21a5cf5a76a170fb322e1c8e73ae130757859800964a008e9f0443c03fc49f52adfd19765d1774c3aa4aae7324e
SSDEEP

384:hXKhQslmZufsXYwux3jTQzE9cHIJ5HqaKDDnSQKr:ZKh6w8hIjTQghjHK/SJ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\xskj_ie.exe"	3cc577a6e0f4c948432661592f8e55bd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xskj_ie.exe	3cc577a6e0f4c948432661592f8e55bd.exe
File opened for modification	C:\Windows\SysWOW64\xskj_ie.exe	3cc577a6e0f4c948432661592f8e55bd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	3cc577a6e0f4c948432661592f8e55bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "ÕÒ¿ªÐÂ´«ÆæË½·þµ½www.okzhaosf.com ËÙ¼Ç: OKÕÒË½·þ"	3cc577a6e0f4c948432661592f8e55bd.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "www.okzhaosf.com"	3cc577a6e0f4c948432661592f8e55bd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2784	3cc577a6e0f4c948432661592f8e55bd.exe

C:\Users\Admin\AppData\Local\Temp\3cc577a6e0f4c948432661592f8e55bd.exe
"C:\Users\Admin\AppData\Local\Temp\3cc577a6e0f4c948432661592f8e55bd.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads