479e5d966f243d73ea0e4f7f2ea868a40068a9917bccabc7393c35904c8cdd70

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7ea75c91e4c995816860addaa9523c71.exe
Size

9KB
MD5

7ea75c91e4c995816860addaa9523c71
SHA1

eb5736d9d77910b5d6925d55901176a9add26040
SHA256

479e5d966f243d73ea0e4f7f2ea868a40068a9917bccabc7393c35904c8cdd70
SHA512

d832131c93300e747fa5c89bc88ac8b05257272d1b3306b3b30efb5873d7f87ad7a86bbb94484040e5f3196c7e7f5febfe87d3810eb403bb3b2112fddb155bb6
SSDEEP

192:zgw6FjqUXOmtS6mcUo2iuY9DUoD44gUaDbHRSpap:zWqUxDUiuYKoD4DcY

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run	7ea75c91e4c995816860addaa9523c71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\kernel32.dll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ea75c91e4c995816860addaa9523c71.exe"	7ea75c91e4c995816860addaa9523c71.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\stdole3.tlb	7ea75c91e4c995816860addaa9523c71.exe
File created	C:\Windows\SysWOW64\stdole3.tlb	7ea75c91e4c995816860addaa9523c71.exe

C:\Users\Admin\AppData\Local\Temp\7ea75c91e4c995816860addaa9523c71.exe
"C:\Users\Admin\AppData\Local\Temp\7ea75c91e4c995816860addaa9523c71.exe"
1⤵
- Adds policy Run key to start application
- Drops file in System32 directory
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads