92e5a2fb9c2403bcdfffc5d91c7cc959da76e0ddd843b2d43a8a3a858f9c90a6

Analysis

max time kernel
361s
max time network
362s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
Size

44KB
MD5

50314317a8b81f235ec751167716512a
SHA1

9e7c1b9d1525571bcf0ca164b67bac0bf230ff5f
SHA256

222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66
SHA512

a6fcf2b91a6d7618e18f2fdcd73854c65416a5f2cf1c6f31896f203e3b478b038f50c758b373979c1fe5a61d39f09a084e5f3e2348870f36abd435ae59ff7607
SSDEEP

384:pnuOsXXDJ2XVnVpYSlLf45iQfr4948DSamC1CgAOasx:pnuOaX12XVB5GamC1Cgp

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Drivers\Etc\Hosts	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Christmas = "C:\\Windows\\System\\christmassend.vbs"	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\loveletter = "C:\\Windows\\System\\loveletter.vbs"	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sendmaileng = "C:\\Windows\\System\\sendmaileng.vbs"	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sendmaildk = "C:\\Windows\\System\\sendmaildk.vbs"	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sendmailfin = "C:\\Windows\\System\\sendmailfin.vbs"	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Windows\\System\\svhost.exe"	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mailsend = "C:\\Windows\\send.vbs"	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe

Drops file in Windows directory 12 IoCs

Processes:

222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe

description	ioc	process
File created	C:\Windows\christmas-love.doc.exe	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\System\loveletter.vbs	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\System\sendmailfin.vbs	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\system\svhost.exe	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\windows\nfofile.nfo	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\System\christmassend.vbs	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\System\sendmaileng.vbs	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\send.vbs	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\document.doc.exe	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File opened for modification	C:\Windows\document.doc.exe	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\LOVE-LETTER-FOR-YOU.TXT.exe	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
File created	C:\Windows\System\sendmaildk.vbs	222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe

C:\Users\Admin\AppData\Local\Temp\222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe
"C:\Users\Admin\AppData\Local\Temp\222d06b23600bbd1fd66b6649618e5f3a7f4d81fcb8dfd961680d949aea31a66.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
PID:2452

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2452-1-0x0000000000980000-0x0000000000A00000-memory.dmp

Filesize
512KB

Download
memory/2452-2-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/2452-0-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/2452-3-0x0000000000980000-0x0000000000A00000-memory.dmp

Filesize
512KB

Download
memory/2452-16-0x000007FEF57F0000-0x000007FEF618D000-memory.dmp

Filesize
9.6MB

Download
memory/2452-17-0x0000000000980000-0x0000000000A00000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads