9ca774b4313eaedf74f32e564863e5bf7b94180164b6ca170804b28aa79ecfe0

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cb652176a5e5203f546ee15803d5a4b.exe
Size

386KB
MD5

4cb652176a5e5203f546ee15803d5a4b
SHA1

11089937d900400e54bab310d2d16e2a6b7b0973
SHA256

9ca774b4313eaedf74f32e564863e5bf7b94180164b6ca170804b28aa79ecfe0
SHA512

1975dd808dda7bab49da868a12183e2fb62e098a35d87efaa24b59b36e3e4c4a8448ab3aa71e42c2f5d267663f6893321f946083a5034945b9a5844003bf7af3
SSDEEP

12288:wxgQmEpTeqdX+YR4xDd0ie845iXh854ouWQgnqSGoYSzHLfTN:wGXwTXdugoW84QXy54ouWQgnqSGoYSzd

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\volume = "C:\\windows\\system\\sysmod.exe"	4cb652176a5e5203f546ee15803d5a4b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\system\sysmod.exe	4cb652176a5e5203f546ee15803d5a4b.exe
File opened for modification	C:\windows\system\sysmod.exe	4cb652176a5e5203f546ee15803d5a4b.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1040	4cb652176a5e5203f546ee15803d5a4b.exe

C:\Users\Admin\AppData\Local\Temp\4cb652176a5e5203f546ee15803d5a4b.exe
"C:\Users\Admin\AppData\Local\Temp\4cb652176a5e5203f546ee15803d5a4b.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-1-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1040-3-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1040-4-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-5-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-6-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1040-8-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-9-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-10-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-13-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-14-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-15-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-16-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-18-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download
memory/1040-19-0x0000000000400000-0x0000000000F773CC-memory.dmp

Filesize
11.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads