6ca130ba72f20992d5755b69cd67a807c86bd7884ae4e3dc5440dd668ad1a583

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mircciOper/mirc.exe
Size

1.9MB
MD5

d20dd1be97ee43da4e7efd0030af834f
SHA1

12f926bc76402a564e6cb49297651273ac742dd9
SHA256

96a27f0a8fe9566e230241cd7f06a43ee9be2adcf160df99626cd584b4806b3c
SHA512

0bc965e3290c817680a6374ed486462d30d439d4462929db5fad935aa481fde7e16063f7e450664ce47a90710d48a7a3268256ca97339c0307acc8427e20af94
SSDEEP

24576:vu171jcC5n7rnCr7idVXDyOf3yz4yr3sjOGDhwYnbwCM/6nfxJBUk/uzP5NCbi9e:AJzV6ZqbwCMifxJBuv6X7CKT

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mirc.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\ = "URL:IRC Protocol"	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.chat\ = "ChatFile"	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\ = "Chat File"	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mircciOper\\mirc.exe\""	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cha	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ifexec\ = "%1"	mirc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Application\ = "mIRC"	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ifexec\ = "%1"	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\URL Protocol	mirc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\command	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Application\ = "mIRC"	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open	mirc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\DefaultIcon	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mircciOper\\mirc.exe\""	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\ = "%1"	mirc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Application	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cha\ = "ChatFile"	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\ddeexec\Topic\ = "Connect"	mirc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\ = "%1"	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\ddeexec\Topic\ = "Connect"	mirc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\EditFlags = 02000000	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.chat	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc	mirc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\irc\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mircciOper\\mirc.exe\" -noconnect"	mirc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\ifexec	mirc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\irc\Shell\open\ddeexec\Topic	mirc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mircciOper\\mirc.exe\" -noconnect"	mirc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2524	mirc.exe
2524	mirc.exe

C:\Users\Admin\AppData\Local\Temp\mircciOper\mirc.exe
"C:\Users\Admin\AppData\Local\Temp\mircciOper\mirc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\mircciOper\mirc.ini

Filesize
5KB

MD5
64862ae4967c286dc7bd3d2e6cebf79f

SHA1
9a16dd6e39333ad732ebaf222d6114684d7bcf8a

SHA256
79cf5d00247d45fc465f7911be37521782732ce56428f293619dcb7f3e45d063

SHA512
e74a62d2768226d3a7079cc7554cf3333a090473e0bb29197927c15118375c43fb1d86896620c4ff668bf6b16d6b99107d9491dcc991c208d2da6f3f1da15bfb

Download Submit