01dda6b6c94108759ed66cdfc91aa3c72fa038fb0acd3cbc9fdba0d293a5def2

Analysis

max time kernel
133s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:48

Target

01dda6b6c94108759ed66cdfc91aa3c72fa038fb0acd3cbc9fdba0d293a5def2.exe
Size

1.3MB
MD5

48239bfd6b07f9a2d9412a1f3f2c76df
SHA1

b4d9968a0f99bcb6cc00eca368e46502b4c2d0d8
SHA256

01dda6b6c94108759ed66cdfc91aa3c72fa038fb0acd3cbc9fdba0d293a5def2
SHA512

4dc1b52b65e8e9d99192035c65c9248c42fda8d66aa1732d264bcbd6eecd80c239b4efda653d777d166b55b0cc797a2528bbd2ad8872d3724aac168e76e6e2a5
SSDEEP

24576:e2CU/OLOQC0tpqqodY1iMrvN/4rEWhhI3HCnajSkMUJtA:2Y/Qf8mNQ7+McMUJi

Score

8^/10

persistence

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Active Setup

Modify Registry

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

2408 explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

explorer.exe

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

Processes:

explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\01dda6b6c94108759ed66cdfc91aa3c72fa038fb0acd3cbc9fdba0d293a5def2.exe
"C:\Users\Admin\AppData\Local\Temp\01dda6b6c94108759ed66cdfc91aa3c72fa038fb0acd3cbc9fdba0d293a5def2.exe"
1⤵
PID:2508