fb775cfa400cd8a5e25a8f1940c73c02c2ef6f92ac48fba7bee562b60797b122

Analysis

max time kernel
133s
max time network
132s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 13:38

Target

d3a70fb165b3f47d89461c62e357d2cd.exe
Size

9KB
MD5

d3a70fb165b3f47d89461c62e357d2cd
SHA1

1b24f90c710fec526a22806ec0b6f6a03c18c32b
SHA256

fb775cfa400cd8a5e25a8f1940c73c02c2ef6f92ac48fba7bee562b60797b122
SHA512

e817845c82bf67deb71ac4f8f95f227637a6e2e64fa8d0d17a25c75ccd0037340462ef3f14f1c5bf9f1bc4a3d8975b04773e1f4e44dcbf44a19f23a76e72a634
SSDEEP

192:q5dJac9onhc5oBSPmIjEnr2slHt0BK7lR:q9HKhc5Y/IRsxt+K7l

Score

8^/10

persistence

Modifies Installed Components in the registry 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{a23ddd81-2ab5-7f0a-7f0a-3bc6661aeaea}	d3a70fb165b3f47d89461c62e357d2cd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{a23ddd81-2ab5-7f0a-7f0a-3bc6661aeaea}\StubPath = "C:\\Windows\\system32\\fzuye\\lsass.exe /t"	d3a70fb165b3f47d89461c62e357d2cd.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\e:	d3a70fb165b3f47d89461c62e357d2cd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fzuye\lsass.exe	d3a70fb165b3f47d89461c62e357d2cd.exe
File created	C:\Windows\SysWOW64\fzuye\lsass.exe	d3a70fb165b3f47d89461c62e357d2cd.exe