1cdf0dcd13a46906d73588a4f2ef20637d25706ce90b53a7b6f1701c28cb3596

Resubmissions

26-03-2024 14:35

240326-ryecksfd5y 10

26-03-2024 14:27

240326-rse2xsfb8y 10

Analysis

max time kernel
1781s
max time network
1564s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe
Size

616KB
MD5

41b91df596878223773cdc49bbee2324
SHA1

48d0647e2e29256d8969dbb7d8edb03297d01ada
SHA256

9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270
SHA512

ff555049812608cb33cd7dcacf1102a920f531281aa60d36e8463f9c48023c856bf0243c25671ac709d8a5dfac5ab1a421606dd3f576472b4ec145b647fae30c
SSDEEP

12288:bnE+Yfz3OlZUW+7xsvceR0KtjYx1xS0v:bEBr3qZlCxarj8xS0v

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe"	9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe

pid process

2932 9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe

pid	process
2932	9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe

C:\Users\Admin\AppData\Local\Temp\9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe
"C:\Users\Admin\AppData\Local\Temp\9da42140cab695b77cde560dd1109d2b96d263e25c21bba0e70604f0717bf270.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2932

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads