d38fc326ca119f21747239f46529491ccf8da316cfbd64f389d211259ac5ce74

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88491a6b6bb26f2162a0f1ab063ba571.exe
Size

32KB
MD5

88491a6b6bb26f2162a0f1ab063ba571
SHA1

f6e6a8876cd7ebebcc6bf48bd46cee9427c69e47
SHA256

d38fc326ca119f21747239f46529491ccf8da316cfbd64f389d211259ac5ce74
SHA512

7a624dac594cd7980f0a6a494b413bca2246248b8314b27255a75d9b3ae9ab47794bafa5fefc67ab3eef37517458952056a2911460fa51e73c4d29a06ded7ac0
SSDEEP

192:/TmRS/eHulx6nwMeU4vkoCMEuQPehhzgqws8qrhVAc7buDqJXhlQhBD9yUEY:/TmRS/yuuUUzuRcLRrD9y/Y

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	88491a6b6bb26f2162a0f1ab063ba571.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sex = "C:\\Windows\\sexlink.exe"	88491a6b6bb26f2162a0f1ab063ba571.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3028	88491a6b6bb26f2162a0f1ab063ba571.exe

C:\Users\Admin\AppData\Local\Temp\88491a6b6bb26f2162a0f1ab063ba571.exe
"C:\Users\Admin\AppData\Local\Temp\88491a6b6bb26f2162a0f1ab063ba571.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads