ac337efd7c48119844958675acb785741108f8ba41acd53ad4a7659c9cd2d2d9

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
100.exe
Size 256KB
Sample240406-2c418acg7x
SHA256 50f8ce3d2974f841523f481362059382d1dce9b4dc840d6050751f4360bef4e3
MD5 1849c7d166fe9c2738f69c8d9fc8166b
SHA1 e1cd056eef47dd85d90e44d94b5bf5842bcaa755
SHA512 bbc9325ff61d73512c03a238986203b5667e40018fa7dc1350e755e16c5820d4495e34f4ee5f9c9110ad98bee98f680d1ee2660f2a066fbb40271b2d13d155bc
SSDEEP 3072:QojVNpbe9kk19/dQAnZOGIjNkieT1uZRV2qwrVHNz+f2xQYXvpI0m5xBPa+g4cVr:/pbPwQAnkVBEhYP4tz+ApIVs4ce6Bh
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\GabPath = "C:\\Users\\Admin\\AppData\\Roaming\\GabPath\\gabpath.exe"	100.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	100.exe

C:\Users\Admin\AppData\Local\Temp\100.exe
"C:\Users\Admin\AppData\Local\Temp\100.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads