17b2d8902b274fe3ae2fa2396b8d153bbd8c433f6de1d48b316ad512dec79d98

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe
Size

57KB
MD5

b8ed4d3d6e349ad4d24c0dfca15c3ac9
SHA1

09cf9b9512582f57a3f13ea3a44240cfa2f8774f
SHA256

17b2d8902b274fe3ae2fa2396b8d153bbd8c433f6de1d48b316ad512dec79d98
SHA512

2376a568171bb8674e509b354899395eacf3e31b644240976f0478338dfb0d0b2a5a3a9048ea62bc104ed58d779c0f4f2ab856aaa0d647c57be159585ddd99f4
SSDEEP

768:d/wDHGNn/BVpnJOOLO/ZpbIOHGWRt6cPLN8eu9cscKrBloURMJBxhGPqyIi8W:d9PFLypsOmWLTNdm9lC+PqyIi

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\VSLJ3W.exe	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe
File created	C:\Windows\VSLJ3W.exe	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3004	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe
3004	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe
3004	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe
3004	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe
3004	b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe

C:\Users\Admin\AppData\Local\Temp\b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe
"C:\Users\Admin\AppData\Local\Temp\b8ed4d3d6e349ad4d24c0dfca15c3ac9.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads