17a507cce4066c4be7db53d64d9a9e11dfecfd4f2411393690506e591b5895cd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7z2401-x64.exe
Size

1.5MB
MD5

de644b4e1086f1315c422f359133543b
SHA1

54be86d121879b0e5d86604297c57a926d665fa8
SHA256

17a507cce4066c4be7db53d64d9a9e11dfecfd4f2411393690506e591b5895cd
SHA512

714d41254352d91834a4b648d613e9b4452b93b097b5781ec5bf3ec7c310a489d3a1c409b2f0a6946822b96f6943b579910d26a5f4324b320d485e856dbdcb1a
SSDEEP

49152:8yEuRNRgYQYk6tC0tkaNuiXatTQY7quUncuTVyvn65:8yEoL7tCzlqLcuBz5

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 3 IoCs

pid	Process
2072	7z2401-x64.exe
2072	7z2401-x64.exe
2072	7z2401-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2401-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2401-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2401-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2401-x64.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe

C:\Users\Admin\AppData\Local\Temp\7z2401-x64.exe
"C:\Users\Admin\AppData\Local\Temp\7z2401-x64.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
\Program Files\7-Zip\7zFM.exe

Filesize
929KB

MD5
6156ebaea891ddbfcb1187f628ec7577

SHA1
778fd5d5dec21f95c5aa554567e06da8295b9a47

SHA256
4853947e14bf30ab40702c34f80fb113c45619a73f89a938f2284c786e35c9fe

SHA512
ed166095ceb46ff77e1081263aea03cb97b5d244a7e4060b6b37c847fd496a7e577f297846414ff130e01484f44f9da2566e2572c6cd69e9b419c311799a511a

Download Submit