c8d2ebd7c1154ab735edd09b522a81fd7ba30e2a8a068816f99f70e528b345e3

Analysis

max time kernel
131s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74eb3ff3e97c504327f444040ca090db.exe
Size

188KB
MD5

74eb3ff3e97c504327f444040ca090db
SHA1

5d698f7fdaac68db7eb1c78360fe74dc334783df
SHA256

c8d2ebd7c1154ab735edd09b522a81fd7ba30e2a8a068816f99f70e528b345e3
SHA512

9da5fc64a3ec60b8b91f23d4ebbcb7c1e5035561f1dd1c056ae97c77474b30455657ec2759c1b3a1b1d154333f51a24e585cbd07dc249d7b3c6cc54486780e1e
SSDEEP

3072:+T6gGr7qc5PS/mxFg+Ws9CUeXfgDyUcPYKiRh30jOV+iMJzUVaJ8a:+Ottx6gouv0O+dUVp

Score

6^/10

collection persistence

Malware Config

Signatures

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

74eb3ff3e97c504327f444040ca090db.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	74eb3ff3e97c504327f444040ca090db.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

74eb3ff3e97c504327f444040ca090db.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	74eb3ff3e97c504327f444040ca090db.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

74eb3ff3e97c504327f444040ca090db.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\RunAppBk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\74eb3ff3e97c504327f444040ca090db.exe"	74eb3ff3e97c504327f444040ca090db.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

480

pid	process
480

outlook_win_path 1 IoCs

Processes:

74eb3ff3e97c504327f444040ca090db.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	74eb3ff3e97c504327f444040ca090db.exe

C:\Users\Admin\AppData\Local\Temp\74eb3ff3e97c504327f444040ca090db.exe
"C:\Users\Admin\AppData\Local\Temp\74eb3ff3e97c504327f444040ca090db.exe"
1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- outlook_win_path
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads