ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe
Size

81KB
MD5

cef506bf2ab673530d99bbc5fef8c468
SHA1

060e78ab9b77608476959b34f6ab1a258546cc57
SHA256

ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f
SHA512

d812d0f759607c38ee8163922005ad9627c609c72457b3ef1c905015cbf3cdd15e863b2499a37c76195639a6feb4144c425fa8712a54ff0c0b65531b3928dd94
SSDEEP

1536:hwdAbnmVhphWZp+iUO++AXljiBimx6gNwJjZf3xUZv:hwdVhpYmG+Tismx6gsluZv

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1708	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	guifx.exe

Loads dropped DLL 1 IoCs

pid	Process
2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Graphics = "\"C:\\ProgramData\\Graphics\\guifx.exe\" /run"	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guifx.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2760	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	30
PID 2704 wrote to memory of 2760	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	30
PID 2704 wrote to memory of 2760	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	30
PID 2704 wrote to memory of 2760	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	30
PID 2704 wrote to memory of 1708	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	31
PID 2704 wrote to memory of 1708	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	31
PID 2704 wrote to memory of 1708	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	31
PID 2704 wrote to memory of 1708	2704	ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe	31

C:\Users\Admin\AppData\Local\Temp\ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe
"C:\Users\Admin\AppData\Local\Temp\ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704
- C:\ProgramData\Graphics\guifx.exe
  "C:\ProgramData\Graphics\guifx.exe" /run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2760
- C:\windows\SysWOW64\cmd.exe
  "C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\ef12e5bf42d3d30cca025fd55aa567fc4b64befdb8a0a2f74ecb84d8ebd4a50f.exe" >> NUL
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Graphics\guifx.exe

Filesize
81KB

MD5
59d8f72dd2d539a054034fcff63813b7

SHA1
daac2eb881ccc87094fc223ef1563490e251b89a

SHA256
3e2773ea85553acb726d235f5e0f4e11c6db7772bc14776c70b739f34503d169

SHA512
778ff98c664772c343d509977eb156521c37b9ad47b6ff6b79efa244d1b62c0ebb8cdfdb76f5c173f1e2a1e82bcedf8390ef3cfdc2de362861bf5a47c67e2802

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads