7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1N.exe
Size

635KB
MD5

1f04174e97b0980cdf45926fd6300ba0
SHA1

cd1ef97d6852ae57ee25516fa189352e4dc44514
SHA256

7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1
SHA512

f648c604aebba8cc531488b143e590fbb8d35b09706995f4c3ff2a2a322f108639de4e2c5f3a325e2afe5ef5f99e3e93e78e700032c048e6b66a212f1a201dd0
SSDEEP

12288:M1NEzLMg+wMkzxB6JwnVgBUnxq9ZPDGWTG/tgts5n16pVuD68w:M1NWL3RB6Jx6xeSWytg218

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSC Boot = "C:\\MicrosoftBootAntivirus\\msseces.exe"	7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSC Boot = "C:\\MicrosoftBootAntivirus\\msseces.exe"	7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1N.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1964	7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1N.exe

C:\Users\Admin\AppData\Local\Temp\7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1N.exe
"C:\Users\Admin\AppData\Local\Temp\7b6eae26f4425a51acda7f620013dc466f6083246248eb9ee4c052a9890e25a1N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1964-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-3-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-4-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-5-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-6-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-7-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-8-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-9-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-10-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-11-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/1964-12-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads