52a3ebb031951a47f40d26ecd19be04bd2eace99488a82b7069bf003f116ee25

Analysis

max time kernel
145s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a1441d5e7542f3f09bea620dee9a781.exe
Size

24KB
MD5

9a1441d5e7542f3f09bea620dee9a781
SHA1

99026c3d56b8e22299bbfe2721eab61f9ac3a692
SHA256

52a3ebb031951a47f40d26ecd19be04bd2eace99488a82b7069bf003f116ee25
SHA512

bf937b9e2b6575c81b5db0895ec2ac0be87450b0566433139ac72fd48578346d8a0476b46ed1a39ada37dd10d0315571bae99e7b1d4d0e9e01471b5a459d6bdb
SSDEEP

384:ZCIAm1aApMC7aHeYZf4km5StBuBoE1mCWN0km5S4:ZL1dJ7KeYZwkm5SjYo2mCWN0km5S4

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9a1441d5e7542f3f09bea620dee9a781 = "9a1441d5e7542f3f09bea620dee9a781.exe"	9a1441d5e7542f3f09bea620dee9a781.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	9a1441d5e7542f3f09bea620dee9a781.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\stray.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Windows\SysWOW64\stray.exe	9a1441d5e7542f3f09bea620dee9a781.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	9a1441d5e7542f3f09bea620dee9a781.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	9a1441d5e7542f3f09bea620dee9a781.exe

C:\Users\Admin\AppData\Local\Temp\9a1441d5e7542f3f09bea620dee9a781.exe
"C:\Users\Admin\AppData\Local\Temp\9a1441d5e7542f3f09bea620dee9a781.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2168