Overview

overview

10

Static

static

3

a1acbfdb96...76.exe

windows7-x64

10

a1acbfdb96...76.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    125s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2024, 03:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a1acbfdb969b2bcae7cee1f6baeb93a66e795cf14afe34afcd74f4d3ab4fd276.exe

  • Size

    133KB

  • MD5

    5509d072e2aaf44677987a8cfadb566d

  • SHA1

    7fd9b8acc4d9add055e034b3ad4781bcd1ec0253

  • SHA256

    a1acbfdb969b2bcae7cee1f6baeb93a66e795cf14afe34afcd74f4d3ab4fd276

  • SHA512

    500befe2072c831dcb55ae63ed3d4aaa6de4b3a51b10cba781898acaa60421e4a827593d952ca3d50b61eea01b763457347cfb9e9e2f4225ab3fae045ebc4cdc

  • SSDEEP

    3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIIIR:ZopGGgbiwU8Je

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Executes dropped EXE 2 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1acbfdb969b2bcae7cee1f6baeb93a66e795cf14afe34afcd74f4d3ab4fd276.exe
    "C:\Users\Admin\AppData\Local\Temp\a1acbfdb969b2bcae7cee1f6baeb93a66e795cf14afe34afcd74f4d3ab4fd276.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\SMSSck.exe
      "C:\Windows\SMSSck.exe" -xInstallOurNiceServicesYes
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:2904
  • C:\Windows\SMSSck.exe
    C:\Windows\SMSSck.exe -xStartOurNiceServicesYes
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SMSSck.exe
    Filesize

    133KB

    MD5

    5509d072e2aaf44677987a8cfadb566d

    SHA1

    7fd9b8acc4d9add055e034b3ad4781bcd1ec0253

    SHA256

    a1acbfdb969b2bcae7cee1f6baeb93a66e795cf14afe34afcd74f4d3ab4fd276

    SHA512

    500befe2072c831dcb55ae63ed3d4aaa6de4b3a51b10cba781898acaa60421e4a827593d952ca3d50b61eea01b763457347cfb9e9e2f4225ab3fae045ebc4cdc

    Download Submit

  • C:\Windows\Temp\htuWsifc.wIS\message.htm
    Filesize

    183KB

    MD5

    ac71f8c212fae6ee42c0796b92165ffa

    SHA1

    438ceacdbb3d31bb22a98c863426c1d2fa80e321

    SHA256

    82b8dca34558cc29723ea6a2e17507494db70d0522f844d0af394ffc5dd0df1c

    SHA512

    1b031fc2495cc4e34ea2f7e9e9ff0733fb2b7251ce2e930aaaeab80da2d858cbe6ff43f5af6aa677a938ec86b9817661dd61f74a9c01a4cb79a5779416a37358

    Download Submit

  • C:\Windows\message.dat
    Filesize

    183KB

    MD5

    5bd29a809f2395a20ff96e8b874810ec

    SHA1

    133ccf2eb7db80154832edc3a8fd84e5c146ba76

    SHA256

    12e4bb8ad8eb72a600dac23f23aa360b0be54a87f0a8621109394148b17117c0

    SHA512

    412f36dfda4d26db57f0814ddf5f308579fac845c59920bc2f0c8693a05992b8763eb9c7f41622d60e1316819f3460f634f85e643aa82e7d00fb54ee756ff273

    Download Submit

  • C:\Windows\svchost.exe
    Filesize

    133KB

    MD5

    bbdff1385906a7d1d2eb3d99affa2bc4

    SHA1

    8b80a0c9f4bd66b55e74c4f54011c5c801b6574b

    SHA256

    f60ea8b0cbc42f7b57a4a97d71d153c00482eabc146f304a84713ae63160c00f

    SHA512

    b480b50a950061e8ab2b57be9b0f5a005bafde2b124dd879ec5324fea0ead3de921db4146fdae2c49ce43187019a0c463e8335f07afb02db81f206418a7c692d

    Download Submit