Analysis

  • max time kernel
    27s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 13:27 UTC

General

  • Target

    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe

  • Size

    867KB

  • MD5

    60a6b724799b55170eaafa005356e39a

  • SHA1

    f1b763a3496f7db90babf162ee99464c1de2652f

  • SHA256

    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3

  • SHA512

    e50e3ec6be5071d217d5af854c616af199764a097af2f0a88cdd20ea1d97257963e86eb352fb7be3c8bc9885c95e5c88440305d7aa8cd4e07a364ef1b54c75d2

  • SSDEEP

    24576:sEa6YRr3IY/CTblgya9FE6i2qaBvMEspaWfZT:sEa6kIBMFtisBvMvbRT

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe
    "C:\Users\Admin\AppData\Local\Temp\ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1340

Network

  • flag-us
    DNS
    r1.joburnt.net
    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe
    Remote address:
    8.8.8.8:53
    Request
    r1.joburnt.net
    IN A
    Response
  • flag-us
    DNS
    c1.allocal.info
    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe
    Remote address:
    8.8.8.8:53
    Request
    c1.allocal.info
    IN A
    Response
  • flag-us
    DNS
    c2.allocal.info
    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe
    Remote address:
    8.8.8.8:53
    Request
    c2.allocal.info
    IN A
    Response
No results found
  • 8.8.8.8:53
    r1.joburnt.net
    dns
    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe
    60 B
    133 B
    1
    1

    DNS Request

    r1.joburnt.net

  • 8.8.8.8:53
    c1.allocal.info
    dns
    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe
    61 B
    140 B
    1
    1

    DNS Request

    c1.allocal.info

  • 8.8.8.8:53
    c2.allocal.info
    dns
    ab0c46119abcf3a4cf914b24c14d7328dfd97dde9faac5f9d99d84f514bc08e3.exe
    61 B
    140 B
    1
    1

    DNS Request

    c2.allocal.info

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1340-54-0x0000000076411000-0x0000000076413000-memory.dmp

    Filesize

    8KB

  • memory/1340-55-0x0000000000AE0000-0x0000000000C25000-memory.dmp

    Filesize

    1.3MB

  • memory/1340-63-0x0000000000AE0000-0x0000000000C25000-memory.dmp

    Filesize

    1.3MB

  • memory/1340-64-0x0000000000AE0000-0x0000000000C25000-memory.dmp

    Filesize

    1.3MB

  • memory/1340-62-0x0000000000AE0000-0x0000000000C25000-memory.dmp

    Filesize

    1.3MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.