Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

7zba89tklZ.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.3674970206945
Filename:	7zba89tklZ.exe
Filesize:	112640
MD5:	2b5e1dfe4e4db4e886b079f054182055
SHA1:	d90e2828ea0082917583975f4a054f7c85d45053
SHA256:	92382cc3402b6fb7cbd68fe7fa49a00ae204682a90fe0b4e69a6ef2c6d324793
SHA512:	954f56680e32e5afb7f70596c10ac74416cc2dda93f1835bfe330660792b8ce9591c56b43a40a3a36b6434aeb59fd0d5c6e189547161db3f9a7f81605f83c087
SSDEEP:	1536:XkhBm8BvFsJMAjrUTXqKgcs5Btdyhy3NZRgYDnRQKlw2LWeSMD+/G:0rjBvKrUbqKgRTHvRgYVQKlw2SeSJO
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0F..t'..t'..t'..}_[.w'..t'..='...QV.e'...Qc.W'...Qb.='...Qg.w'...QU.u'..Richt'..........PE..L....jdg...........................

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Found API chain indicative of debugger detection	Anti Debugging	Virtualization/Sandbox Evasion
Machine Learning detection for sample	AV Detection
Abnormal high CPU Usage	System Summary	System Time Discovery System Information Discovery
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Drops PE files	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found evasive API chain (may stop execution after checking a module file name)	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Sample execution stops while process was sleeping (likely an evasion)	Malware Analysis System Evasion
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery System Information Discovery
Contains functionality to register its own exception handler	Anti Debugging
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Creates files inside the user directory	System Summary	Masquerading
Creates mutexes	System Summary
Might use command line arguments	System Summary	Command and Scripting Interpreter Masquerading
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Users\user\AppData\Local\Microsoft\svcapp.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\svcapp.exe
Category:	dropped
Dump:	svcapp.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\7zba89tklZ.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.3674970206945
Encrypted:	false
Ssdeep:	1536:XkhBm8BvFsJMAjrUTXqKgcs5Btdyhy3NZRgYDnRQKlw2LWeSMD+/G:0rjBvKrUbqKgRTHvRgYVQKlw2SeSJO
Size:	112640
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Found evasive API chain (may stop execution after checking mutex)	Malware Analysis System Evasion	Native API
Machine Learning detection for dropped file	AV Detection
Drops PE files	Persistence and Installation Behavior
Found evasive API chain (may stop execution after checking a module file name)	Malware Analysis System Evasion	Native API
Found large amount of non-executed APIs	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Program exit points	Malware Analysis System Evasion
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

C:\Users\user\AppData\Local\Microsoft\svcapp.exe:Zone.Identifier

ASCII text, with CRLF line terminators

modified

Details

File:	C:\Users\user\AppData\Local\Microsoft\svcapp.exe:Zone.Identifier
Category:	modified
Dump:	svcapp.exe_Zone.Identifier.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\7zba89tklZ.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	3.95006375643621
Encrypted:	false
Ssdeep:	3:ggPYV:rPYV
Size:	26
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found evasive API chain (may stop execution after checking mutex)	Malware Analysis System Evasion	Native API
Machine Learning detection for dropped file	AV Detection
Found evasive API chain (may stop execution after checking a module file name)	Malware Analysis System Evasion	Native API
Found large amount of non-executed APIs	Malware Analysis System Evasion
Program exit points	Malware Analysis System Evasion
Tries to load missing DLLs	System Summary	DLL Side-Loading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\7zba89tklZ.exe

"C:\Users\user\Desktop\7zba89tklZ.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5700
Target ID:	0
Parent PID:	1028
Name:	7zba89tklZ.exe
Path:	C:\Users\user\Desktop\7zba89tklZ.exe
Commandline:	"C:\Users\user\Desktop\7zba89tklZ.exe"
Size:	112640
MD5:	2B5E1DFE4E4DB4E886B079F054182055
Time:	01:20:28
Date:	23/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x4f0000
Modulesize:	131072
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Users\user\Desktop\7zba89tklZ.exe

"C:\Users\user\Desktop\7zba89tklZ.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4836
Target ID:	2
Parent PID:	1028
Name:	7zba89tklZ.exe
Path:	C:\Users\user\Desktop\7zba89tklZ.exe
Commandline:	"C:\Users\user\Desktop\7zba89tklZ.exe"
Size:	112640
MD5:	2B5E1DFE4E4DB4E886B079F054182055
Time:	01:20:36
Date:	23/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x4f0000
Modulesize:	131072
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Users\user\AppData\Local\Microsoft\svcapp.exe

"C:\Users\user\AppData\Local\Microsoft\svcapp.exe"

Details

Is windows:	false
Is dropped:	true
PID:	5416
Target ID:	3
Parent PID:	1028
Name:	svcapp.exe
Path:	C:\Users\user\AppData\Local\Microsoft\svcapp.exe
Commandline:	"C:\Users\user\AppData\Local\Microsoft\svcapp.exe"
Size:	112640
MD5:	2B5E1DFE4E4DB4E886B079F054182055
Time:	01:20:44
Date:	23/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x370000
Modulesize:	131072
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files	Persistence and Installation Behavior
Creates files inside the user directory	System Summary	Masquerading
Spawns processes	System Summary	Process Injection

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SystemHandler

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	SystemHandler
Value data:	C:\Users\user\Desktop\7zba89tklZ.exe

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SystemHandler

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value name:	SystemHandler
Value data:	C:\Users\user\AppData\Local\Microsoft\svcapp.exe

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

Memdumps

Base Address

Regiontype

Protect

Malicious

BC0000

heap

page read and write

7D0000

heap

page read and write

DC0000

heap

page read and write

1615000

heap

page read and write

50D000

unkown

page readonly

DF0000

heap

page read and write

371000

unkown

page execute read

30B0000

heap

page read and write

384000

unkown

page readonly

DF5000

heap

page read and write

4F1000

unkown

page execute read

504000

unkown

page readonly

F80000

heap

page read and write

87E000

stack

page read and write

12AE000

heap

page read and write

4F0000

unkown

page readonly

DB0000

heap

page read and write

38D000

unkown

page readonly

12A0000

heap

page read and write

2DE0000

heap

page read and write

8D0000

heap

page read and write

12AA000

heap

page read and write

4F1000

unkown

page execute read

38A000

unkown

page write copy

25F0000

heap

page read and write

CCE000

stack

page read and write

6FD000

stack

page read and write

4F0000

unkown

page readonly

371000

unkown

page execute read

8DE000

heap

page read and write

ACE000

stack

page read and write

FC0000

heap

page read and write

DD0000

heap

page read and write

38D000

unkown

page readonly

504000

unkown

page readonly

384000

unkown

page readonly

50A000

unkown

page write copy

36C000

stack

page read and write

8DA000

heap

page read and write

7E0000

heap

page read and write

50D000

unkown

page readonly

1610000

heap

page read and write

4F1000

unkown

page execute read

504000

unkown

page readonly

1180000

heap

page read and write

50A000

unkown

page write copy

FE0000

heap

page read and write

10FC000

stack

page read and write

BC5000

heap

page read and write

D4C000

stack

page read and write

83E000

stack

page read and write

38A000

unkown

page read and write

4F1000

unkown

page execute read

370000

unkown

page readonly

F4C000

stack

page read and write

504000

unkown

page readonly

1390000

heap

page read and write

50D000

unkown

page readonly

FD0000

heap

page read and write

12FD000

stack

page read and write

7F0000

heap

page read and write

1398000

heap

page read and write

4F0000

unkown

page readonly

2D7C000

stack

page read and write

50D000

unkown

page readonly

322F000

stack

page read and write

370000

unkown

page readonly

50A000

unkown

page read and write

3F0000

heap

page read and write

4F0000

unkown

page readonly

50A000

unkown

page read and write

There are 61 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
7zba89tklZ.exe

Files

Processes

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report7zba89tklZ.exe

Files

Processes

Registry

Memdumps

IOC Report
7zba89tklZ.exe