Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-10-2024 16:16

General

  • Target

    7z2408/7z2408-x64.exe

  • Size

    1.5MB

  • MD5

    0330d0bd7341a9afe5b6d161b1ff4aa1

  • SHA1

    86918e72f2e43c9c664c246e62b41452d662fbf3

  • SHA256

    67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

  • SHA512

    850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

  • SSDEEP

    24576:UEBmEo1y9fcw5K42KmEDaMYAhr08oSG4OdWrfjcaHSNXJdx7wE9iko6qzLJmYYUP:UEvoo24xV2JJdPwMJ3x75z5q0jc/3

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7z2408\7z2408-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\7z2408\7z2408-x64.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    PID:3000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\7-Zip\7-zip.dll

    Filesize

    99KB

    MD5

    956d826f03d88c0b5482002bb7a83412

    SHA1

    560658185c225d1bd274b6a18372fd7de5f336af

    SHA256

    f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

    SHA512

    6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

  • \Program Files\7-Zip\7zFM.exe

    Filesize

    963KB

    MD5

    004d7851f74f86704152ecaaa147f0ce

    SHA1

    45a9765c26eb0b1372cb711120d90b5f111123b3

    SHA256

    028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be

    SHA512

    16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29