7f2a57440ef2410df9479224b61cfb1e514bb8c2671611929000f7f9f9101b83

Analysis

max time kernel
16s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b7be5c5541c0ff8a2b39a08ca2c3370N.exe
Size

32KB
MD5

8b7be5c5541c0ff8a2b39a08ca2c3370
SHA1

751fa4074b9fdccd429d93f2a5411e124141d16b
SHA256

7f2a57440ef2410df9479224b61cfb1e514bb8c2671611929000f7f9f9101b83
SHA512

2cfbe0073a098e49a736a3a91818a9d420d470cfa1e7d6a250931a05062509e1bca6d09a9875f51690f5e9f0a98413fcb272aa2d479d0f1e9c1e96eae15526a8
SSDEEP

384:Q98xUHQoYhmWPSQy4Ng8zLeiTer0WYLVNYjxJ52Al1DqPRaXBwEegvg:TwMmi5/gop/YYucP4w/Gg

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHttpAutoProxySvc = "C:\\Users\\Admin\\AppData\\Local\\WinHttpAutoProxySvc.exe"	regedit.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2388	regedit.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe
2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2388	2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe	30
PID 2716 wrote to memory of 2388	2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe	30
PID 2716 wrote to memory of 2388	2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe	30
PID 2716 wrote to memory of 2388	2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe	30
PID 2716 wrote to memory of 2388	2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe	30
PID 2716 wrote to memory of 2388	2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe	30
PID 2716 wrote to memory of 2388	2716	8b7be5c5541c0ff8a2b39a08ca2c3370N.exe	30

C:\Users\Admin\AppData\Local\Temp\8b7be5c5541c0ff8a2b39a08ca2c3370N.exe
"C:\Users\Admin\AppData\Local\Temp\8b7be5c5541c0ff8a2b39a08ca2c3370N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

Filesize
190B

MD5
90fe04f21bfb4a8b54c85fb5d9f9c8f8

SHA1
67e1f28d0ccc3715a2dec98100577bf06d1e997e

SHA256
205871d41c4ab41ca1b57f25e516de0b36d1c62841dc51fc41f4b7e8367d19fc

SHA512
d76baa34361cd644f938f6100ce66b3084972bce2dafdb50b72930bd61c8b79462a123eed8697f184a1a176e6642a13542b331875d0ccb39b7d599724c89d213

Download Submit
C:\Users\Admin\AppData\Local\WinHttpAutoProxySvc.exe

Filesize
32KB

MD5
328d31e2bfed699e10810511a99d0c27

SHA1
cd6a9b9725453adb1ac41a3da1be4fac0860f6c7

SHA256
a9c7703ed03023c0d1a541f8ad853af1d653d6f61340f35c928574466626419a

SHA512
6d74ce718db16230e77ba4218c4c9b1bd9f897f8f0b46f2c01de8f81771bf7c878140b50877986378ea364b7a7e6fa95cde1c69e5b9f360d96f330fd68125a33

Download Submit
memory/2716-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2716-1-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/2716-2-0x0000000000020000-0x0000000000028000-memory.dmp

Filesize
32KB

Download
memory/2716-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads