8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data/Zip.exe
Size 263KB
Sample240527-v2fllacf56
SHA256 2293fe261d5c6f5f2a33004b11f068037677b7aa5a6f792031e31555f31f0d69
MD5 9a2ea4da5eec75298f16ba444d3a98d6
SHA1 f4f790430556e36d418498cd2f3112d04dabf877
SHA512 69c86181722d2416c1836c9d24df268ba04704898643d2e741d76d1f1493cd140013c95d8e00ce7a95a280cdd5869769a0fffa2fb0c8dc41bb4c8d8fd69f58f4
SSDEEP 3072:sv/MtM8A6OOodzRMOSgNs2Dsx7Cwbj59HvhaxO6M65ysytvg6VNf0ETA8B9kxpjK:sstlOOo8x7n59Z+zyu65QxpX+t4sP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	Zip.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1744	Zip.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1744	Zip.exe
1744	Zip.exe

C:\Users\Admin\AppData\Local\Temp\data\Zip.exe
"C:\Users\Admin\AppData\Local\Temp\data\Zip.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads