7a08ad041d4322efae6fe5c41437ba54f049401b8642d33596ec392a559eebc0 | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7e144e055e16e458de45b25e433cee6.exe
Size

157KB
MD5

c7e144e055e16e458de45b25e433cee6
SHA1

060b32d2e96d7729754c76b9c08b77ad701ae22d
SHA256

7a08ad041d4322efae6fe5c41437ba54f049401b8642d33596ec392a559eebc0
SHA512

c061423ec51d292c43cbcf0548009bd86765f89e2f7d241fdc89554957ebc981b9f064610a5865dd0890fa41f78e4700705b219335fa47dbf497c38e9df2aa48
SSDEEP

3072:OzFNAyq8UHG8RbGWzfq6ZFrA/O02SUROGx2h7tR1mQvy4:QBZUFxqIa08QYrs

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wintab.exe	c7e144e055e16e458de45b25e433cee6.exe
File created	C:\Windows\SysWOW64\wintab.exe	c7e144e055e16e458de45b25e433cee6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\tab32.dll	c7e144e055e16e458de45b25e433cee6.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{370A7BF5-708D-4DE7-B6E9-663466C30294}	c7e144e055e16e458de45b25e433cee6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{370A7BF5-708D-4DE7-B6E9-663466C30294}\	c7e144e055e16e458de45b25e433cee6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{370A7BF5-708D-4DE7-B6E9-663466C30294}\InProcServer32	c7e144e055e16e458de45b25e433cee6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{370A7BF5-708D-4DE7-B6E9-663466C30294}\InProcServer32\ = "C:\\Windows\\tab32.dll"	c7e144e055e16e458de45b25e433cee6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{370A7BF5-708D-4DE7-B6E9-663466C30294}\InProcServer32\ThreadingModel = "Apartment"	c7e144e055e16e458de45b25e433cee6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2324	c7e144e055e16e458de45b25e433cee6.exe

C:\Users\Admin\AppData\Local\Temp\c7e144e055e16e458de45b25e433cee6.exe
"C:\Users\Admin\AppData\Local\Temp\c7e144e055e16e458de45b25e433cee6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-2-0x0000000000220000-0x0000000000248000-memory.dmp

Filesize
160KB

Download
memory/2324-4-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download