8d7e1881b51aabc18d7f115d81670bb54db5eaa4ac7ff4b3ec7a02266270322c

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 15:36 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89e3fcf78ee6adf150161dcf968cdc32.exe
Size

575KB
MD5

89e3fcf78ee6adf150161dcf968cdc32
SHA1

c8e73d0992134fa1caa619bc0a516d0992bdcb8e
SHA256

8d7e1881b51aabc18d7f115d81670bb54db5eaa4ac7ff4b3ec7a02266270322c
SHA512

552e1ce73443cf23e3a2afdb43efd12f1e36cdb8c8134938611f3b3815a70cd290609fefe88c1005cc2f3ad58bd78bce5e2910f3d9185d5ee458b6aa329e3282
SSDEEP

12288:0bwxo/yRtdBcbkoUQEk2Ehrs2gyhUbDXWHVzrG7i:jxNZEU4hI2VqsVmi

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\89e3fcf78ee6adf150161dcf968cdc32.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\89e3fcf78ee6adf150161dcf968cdc32.exe"	89e3fcf78ee6adf150161dcf968cdc32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1888	89e3fcf78ee6adf150161dcf968cdc32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1888	89e3fcf78ee6adf150161dcf968cdc32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1888	89e3fcf78ee6adf150161dcf968cdc32.exe
1888	89e3fcf78ee6adf150161dcf968cdc32.exe

C:\Users\Admin\AppData\Local\Temp\89e3fcf78ee6adf150161dcf968cdc32.exe
"C:\Users\Admin\AppData\Local\Temp\89e3fcf78ee6adf150161dcf968cdc32.exe"
1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-0-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download
memory/1888-10-0x0000000000400000-0x00000000005DA000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.