Overview

overview

7

Static

static

3

7z2405-x64.exe

windows7-x64

7

7z2405-x64.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    20s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    17-05-2024 06:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7z2405-x64.exe

  • Size

    1.5MB

  • MD5

    c73433dd532d445d099385865f62148b

  • SHA1

    4723c45f297cc8075eac69d2ef94e7e131d3a734

  • SHA256

    12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9

  • SHA512

    1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447

  • SSDEEP

    49152:ZEVAbJqaITViU3qLkr7toP9KT+uv6WC+5uxe1o58:ZEVcqeUaki9oBqt+

Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"
    1⤵
    • Loads dropped DLL
    • Registers COM server for autorun
    • Drops file in Program Files directory
    • Modifies registry class
    PID:1640
  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\7-Zip\7-zip.dll
    Filesize

    99KB

    MD5

    956d826f03d88c0b5482002bb7a83412

    SHA1

    560658185c225d1bd274b6a18372fd7de5f336af

    SHA256

    f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

    SHA512

    6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

    Download Submit
  • \Program Files\7-Zip\7zFM.exe
    Filesize

    960KB

    MD5

    b161d842906239bf2f32ad158bea57f1

    SHA1

    4a125d6cbeae9658e862c637aba8f8b9f3bf5cf7

    SHA256

    3345c48505e0906f1352499ba7cbd439ac0c509a33f04c7d678e2c960c8b9f03

    SHA512

    0d14c75c8e80af8246ddf122052190f5ffb1f81ffd5b752990747b7efcb566b49842219d9b26df9dbe267c9a3876d7b60158c9f08d295d0926b60dbbebc1fa3c

    Download Submit