Analysis
- max time kernel
27s - max time network
29s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
24/02/2024, 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7z2301-x64.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
7z2301-x64.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 7z2301-x64.exe
- Size 1.5MB
- Sample240224-xdvfysbc28
- SHA256 26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
- MD5 e5788b13546156281bf0a4b38bdd0901
- SHA1 7df28d340d7084647921cc25a8c2068bb192bdbb
- SHA512 1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff
- SSDEEP 49152:RoOF3Wh8esAMmyyImtH97VTjrtlEfmSX4b:RoYWh8JAV/VH97F3tlQ+b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 2920 7z2301-x64.exe 2920 7z2301-x64.exe 2920 7z2301-x64.exe 1212 Process not Found 1212 Process not Found 1212 Process not Found - Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2301-x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\History.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 7z2301-x64.exe File created C:\Program Files\7-Zip\7-zip.dll 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 7z2301-x64.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\License.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2301-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 7z2301-x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2301-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2301-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2301-x64.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Program Files\7-Zip\7-zip.dll
- Size 99KB
- SHA256 f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d
- MD5 956d826f03d88c0b5482002bb7a83412
- SHA1 560658185c225d1bd274b6a18372fd7de5f336af
- SHA512 6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647
- SSDEEP 1536:T842/mwxwckhjRE3ng2Ey8thQjGYZ1JrTGvWSy/PEw22mGYTNAkQz:TY/bx7kFe3VZ7rTGvWSo28YbQz
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files\7-Zip\7zFM.exe
- Size 930KB
- SHA256 1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
- MD5 30ac0b832d75598fb3ec37b6f2a8c86a
- SHA1 6f47dbfd6ff36df7ba581a4cef024da527dc3046
- SHA512 505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057
- SSDEEP 12288:kRKcv8Nh7py6Rmi78gkPH3aPI9vyVg/0paQuj3IdD02fKBjtp/:JBpDRmi78gkPXlyo0G/jr
- MD5 SHA1 SHA512 SSDEEP