b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Size

178KB
MD5

7c72fa73b9c245055a395575a827d301
SHA1

41e22780dffed09ee4564592d92bb7e1d762cf96
SHA256

b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a
SHA512

fb38e805a83f6ba99da6ab406764644afa677eb4d081c1f01d507b23793d6768a9616ec0e3a69a8701b6c3bb48f576bbcea6bc39ba23e3dfbc0f36805f378aff
SSDEEP

3072:Z64MKbOFxL/xjzq+5BUaFPmgRMNlPTGQQm6ytwZEsrYkK4Py6u3OD:Z64dc/B98gWNlPTGQQm6agrdF

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GBPOLL = "C:\\Windows\\IjCvj0V9VPY.exe"	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe

Drops file in Windows directory 2 IoCs

Processes:

b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe

description	ioc	process
File created	C:\Windows\IjCvj0V9VPY.exe	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
File opened for modification	C:\Windows\IjCvj0V9VPY.exe	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe

Modifies registry class 16 IoCs

Processes:

b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\InProcServer32\	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\ProgID	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\ProgID\ = "Msxml2.MXHTMLWriter.6.0"	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\TypeLib\ = "{575903CE-586E-4C7C-38BE-B6A8A8A8CB9A}"	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\Version	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\ = "Vokadome object"	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\InProcServer32\ = "C:\\Windows\\SysWOW64\\msxml6.dll"	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{575903CE-586E-4C7C-38BE-B6A8A8A8CB9A}	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{575903CE-586E-4C7C-38BE-B6A8A8A8CB9A}\	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\TypeLib\	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\ProgID\	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\Version\	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\Version\ = "6.0"	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\InProcServer32	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2A37EB67-321B-4FBA-D79C-2F917C0CED3E}\TypeLib	b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe

C:\Users\Admin\AppData\Local\Temp\b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe
"C:\Users\Admin\AppData\Local\Temp\b3e7b7563cc8cfbe51e11a845702fa8fc5d7f869128c09909b57b2bf0c73228a.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
PID:912

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/912-1-0x0000000002100000-0x0000000002143000-memory.dmp

Filesize
268KB

Download
memory/912-6-0x00000000022F0000-0x00000000022F2000-memory.dmp

Filesize
8KB

Download
memory/912-5-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/912-4-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/912-3-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/912-2-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/912-8-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/912-7-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/912-20-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/912-17-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/912-15-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/912-22-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/912-21-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/912-50-0x0000000002C30000-0x0000000002C31000-memory.dmp

Filesize
4KB

Download
memory/912-49-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/912-48-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/912-47-0x0000000002C40000-0x0000000002C41000-memory.dmp

Filesize
4KB

Download
memory/912-46-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/912-52-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/912-51-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/912-45-0x0000000002C20000-0x0000000002C21000-memory.dmp

Filesize
4KB

Download
memory/912-54-0x0000000006480000-0x0000000006481000-memory.dmp

Filesize
4KB

Download
memory/912-53-0x0000000006490000-0x0000000006491000-memory.dmp

Filesize
4KB

Download
memory/912-44-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download
memory/912-43-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/912-42-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/912-41-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/912-40-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/912-39-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/912-38-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/912-37-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/912-36-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/912-35-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/912-34-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/912-33-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/912-32-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/912-31-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/912-30-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/912-29-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/912-28-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/912-27-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/912-26-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/912-25-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/912-24-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/912-23-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/912-14-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/912-13-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/912-12-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/912-11-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/912-10-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/912-9-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/912-56-0x0000000006660000-0x0000000006661000-memory.dmp

Filesize
4KB

Download
memory/912-55-0x0000000006670000-0x0000000006671000-memory.dmp

Filesize
4KB

Download
memory/912-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/912-59-0x0000000002100000-0x0000000002143000-memory.dmp

Filesize
268KB

Download
memory/912-63-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/912-67-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/912-71-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download