22cda0ab9267828694f069a68f88caf8a72e8b516e519c0758b1502d9345d884

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

键盘记录器7.1 华军版/monitor.exe
Size

112KB
MD5

f6c953feb4d30d4ac6739cb5120f4243
SHA1

39ac18004c3df8539c06c8cc82d04699c686bf73
SHA256

ed99b7605b92ace778f2585d80c90cb10c6a4b29460e73aa3bb5e2d9c866860f
SHA512

a2ca415908e33d98a75027658089c82f93862c0d7f038ca0a5b02aada96c5db2246188f28c4d779be4d75753e93d721547d969ccbf40f670346fba9fbd382790
SSDEEP

1536:/LTXC1sKCGGH9kk9zHYt2X3f/SLcRH3PP2mngmqB9Ip850pf5vP20SP5YfNfaPFl:HcCtd39zdfaLcRHmwtFmGf0SMl4l8

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/memory/2496-0-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral7/memory/2496-1-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral7/memory/2496-6-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral7/memory/2496-12-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\keyboardlog = "C:\\Users\\Admin\\AppData\\Local\\Temp\\?????7.1 ???\\monitor.exe"	monitor.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2496	monitor.exe
2496	monitor.exe
2496	monitor.exe

C:\Users\Admin\AppData\Local\Temp\键盘记录器7.1 华军版\monitor.exe
"C:\Users\Admin\AppData\Local\Temp\键盘记录器7.1 华军版\monitor.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2496-1-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2496-6-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2496-12-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads