d78a876931af37eaaa886a4593eebd9fc15125299eacf3b6ce1d413fc97e2d4d

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d78a876931af37eaaa886a4593eebd9fc15125299eacf3b6ce1d413fc97e2d4d.exe
Size

52KB
MD5

6f80b2b62732d20a60b0bb5652518920
SHA1

4153f662357c55aa64a7a99a3892dba2709d4d8b
SHA256

d78a876931af37eaaa886a4593eebd9fc15125299eacf3b6ce1d413fc97e2d4d
SHA512

f7a41e5aa15d6f8cedaf3898989aca83c2d0b7b3a5649c1b03777e0ba539a122527e12b1c931e9278e6640b413be178ab48470897cc0102fdabf1239829a5e13
SSDEEP

768:KPZuGCzRsET30cfS1+fGvVXGriKkfTiRNej7gY2jT0/:KPZ2RsEJWNWriBT/F2fq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.t2t2.net/?gg"	d78a876931af37eaaa886a4593eebd9fc15125299eacf3b6ce1d413fc97e2d4d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1932	d78a876931af37eaaa886a4593eebd9fc15125299eacf3b6ce1d413fc97e2d4d.exe

C:\Users\Admin\AppData\Local\Temp\d78a876931af37eaaa886a4593eebd9fc15125299eacf3b6ce1d413fc97e2d4d.exe
"C:\Users\Admin\AppData\Local\Temp\d78a876931af37eaaa886a4593eebd9fc15125299eacf3b6ce1d413fc97e2d4d.exe"
1⤵
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download