ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe
Size

206KB
MD5

5adb9430547499adcf47a82bc78110be
SHA1

de26def488ae242618bd5e248722552f66a59b56
SHA256

ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f
SHA512

1b8ec999d32691b272c87e35324927dc29770d78f5ad1877434a30f97411af085f20c74614e15194e22702141e6d5db18eecf4eb59c90b5ad6322f3dfbd1118a
SSDEEP

3072:Rj4uE6ybPIoqXK4g1sl7GMJIIyNPQHkn+wmq/Hxr8wK8D3Avw3lwh:RNE6Q91slaMJIIyNPQH+/WHAQwwh

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2008	ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SOFT\General - Configurar SafeSign\~GLH0000.TMP	ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe
File opened for modification	C:\Program Files (x86)\SOFT\General - Configurar SafeSign\Uninstal.EXE	ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe
File opened for modification	C:\Program Files (x86)\SOFT\General - Configurar SafeSign\INSTALL.LOG	ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe
File created	C:\Program Files (x86)\SOFT\General - Configurar SafeSign\INSTALL.LOG	ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe

C:\Users\Admin\AppData\Local\Temp\ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe
"C:\Users\Admin\AppData\Local\Temp\ca4b175b4cc69c5a20423a265524cd4ca448d7e0b3586c08794457dc0fbc2e0f.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLCA0E1.tmp

Filesize
156KB

MD5
ca5ecbb86edf2187ee33022e0bca2787

SHA1
bd550bbe685c42d13ce3eba66aae7b2c82c769e9

SHA256
9dabe9a3444d2a633f26db4c6784cc17d20373b6e97dfe333c215921aebd9487

SHA512
c2d776ad52972f98d95a08d5e68bc2ef1f133dd5f7419d0a12180037fb42a8383ccfcc522155f5355af607b31b6ea88bdc381a4feee4e0318f04bbd78e62e3a8

Download Submit