Analysis
-
max time kernel
39s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 08:24
General
-
Target
7z2405-x64.exe
-
Size
1.5MB
-
MD5
c73433dd532d445d099385865f62148b
-
SHA1
4723c45f297cc8075eac69d2ef94e7e131d3a734
-
SHA256
12ef1c8127ec3465520e4cfd23605b708d81a5a2cf37ba124f018e5c094de0d9
-
SHA512
1211c8b67652664d6f66e248856b95ca557d4fdb4ea90d30df68208055d4c94fea0d158e7e6a965eae5915312dee33f62db882bb173faec5332a17bd2fb59447
-
SSDEEP
49152:ZEVAbJqaITViU3qLkr7toP9KT+uv6WC+5uxe1o58:ZEVcqeUaki9oBqt+
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 20 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"C:\Users\Admin\AppData\Local\Temp\7z2405-x64.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\7-Zip\7z.exe"C:\Program Files\7-Zip\7z.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD53428b9967f63c00213d6dbdb27973996
SHA11cf56abc2e0b71f5a927ea230c8cca073d20fc97
SHA25656008756553ea5876fb8aad98f6f5dbca1ba14c5e53f4fa9ec318e355e146a7e
SHA512b876b39d030818ce7879eb9bb5ff4375712cf145b7457a815880bf010215bd9dcde539e7d0877c56558e0d23a310bc75bfb9d315f9966cbda4ae02a7821980cc
-
Filesize
548KB
MD5e1e36ca1443a94afda63fff08db41d9e
SHA1e003b8b4ad6b024c808f422b8e09257811c55ec5
SHA256fcdf41ab5a749e82575d36365bf11e8ce9b52d05c9058cd3589c8c2c8c4f59f5
SHA51299df04b41492108af134ab67964584e07549a1ed32329815e1f9814e5cbaf6c3ee72b3d9fd17b30347d8e22009b489f7329ed48e25422cdaf1a3775515435b6a
-
Filesize
960KB
MD5b161d842906239bf2f32ad158bea57f1
SHA14a125d6cbeae9658e862c637aba8f8b9f3bf5cf7
SHA2563345c48505e0906f1352499ba7cbd439ac0c509a33f04c7d678e2c960c8b9f03
SHA5120d14c75c8e80af8246ddf122052190f5ffb1f81ffd5b752990747b7efcb566b49842219d9b26df9dbe267c9a3876d7b60158c9f08d295d0926b60dbbebc1fa3c
-
Filesize
691KB
MD5ebff295ea5bb139eb04c699e1a52c286
SHA14d71053397304ab545f246ed6676d5927691b833
SHA256835d114678b311e938ee235519be252b38f14f2c5117d3ee3b905f09f0615f94
SHA5124320277436d737efb3ea04515a52ec86102a02f840b2f16d8f27673244124e149f01eee15870448710ec015c103a83f8bbf491f9928dbc1bc1b55236da8473b9