61b34663450ad30e4ee3f29dfa83592cd089a5a4c513009f926211c6bb564b66

Analysis

max time kernel
149s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e449cb82012bea27418f19cf63583e0.exe
Size

334KB
MD5

7e449cb82012bea27418f19cf63583e0
SHA1

bd7bf3f4a921f0e953c429debc2abdeb67f06293
SHA256

61b34663450ad30e4ee3f29dfa83592cd089a5a4c513009f926211c6bb564b66
SHA512

77b3f1d28b6afb1d9648aa68bf123fa83296697e25c22207feb09a5b8e545dfedb522225a20e168782a2dcaefa6185d75718b7c5d64e47087e1808f289fc2128
SSDEEP

6144:fGp1OXSkpOPMKreESCBJTNNHa+aNo1xYri5pFAmbBal7Y8dbsSFycVPuNw:ZSoOP1rukTrpaC1+rqpFS5LhsSIcVPuq

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\iexplorerskut = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e449cb82012bea27418f19cf63583e0.exe"	7e449cb82012bea27418f19cf63583e0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\my.log	7e449cb82012bea27418f19cf63583e0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	7e449cb82012bea27418f19cf63583e0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2068	7e449cb82012bea27418f19cf63583e0.exe
2068	7e449cb82012bea27418f19cf63583e0.exe

C:\Users\Admin\AppData\Local\Temp\7e449cb82012bea27418f19cf63583e0.exe
"C:\Users\Admin\AppData\Local\Temp\7e449cb82012bea27418f19cf63583e0.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\my.log

Filesize
21B

MD5
d0c42dc9d304ec2ebbddbf011ba534f2

SHA1
3a4bf3297ceb728cb33a4a78c7004195c0ad514c

SHA256
dc3cbc2328087b0a85cb933e308031bebf6076ff6794edde93e01e1ff54eacc0

SHA512
5001ecc4fb567fd461eeac68037355bc3612d43b5a437a377176f41581901693accd421e7a1ac87d36b60c6798e4fcb4ad7110cfdeddc5b884885b6d5af958d1

Download Submit
memory/2068-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2068-1-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2068-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2068-6-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2068-10-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2068-11-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads