Analysis

  • max time kernel
    44s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 04:09

General

  • Target

    abe9e32efd4b21d39f6b6c0048c631c16b7b5717b2993e9a1bc3432570fa09fe.exe

  • Size

    795KB

  • MD5

    88752afc6aff5013adbcca15916b66be

  • SHA1

    eed2f62fe28bb7f0b23f18a9c83694b63b8bcd20

  • SHA256

    abe9e32efd4b21d39f6b6c0048c631c16b7b5717b2993e9a1bc3432570fa09fe

  • SHA512

    6c3c9dc1caa69823d423cf81344da8f3f5ae24ddb0c835f422efb5daff52040f28d628f99cb1bd76d1c75d782c64bf92b79196098731ca4ec3905955766fd408

  • SSDEEP

    12288:l7wupoGudZCWfjkoSjzZGNFr7ANb7/v02NjgBleWiku/gLoQNR5eVJHTmE+zFUPX:lfc07/vNjYz6Zi5CHTngF8CZo

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abe9e32efd4b21d39f6b6c0048c631c16b7b5717b2993e9a1bc3432570fa09fe.exe
    "C:\Users\Admin\AppData\Local\Temp\abe9e32efd4b21d39f6b6c0048c631c16b7b5717b2993e9a1bc3432570fa09fe.exe"
    1⤵
    • Registers COM server for autorun
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1600

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

    Filesize

    8KB

  • memory/1600-55-0x0000000000B10000-0x0000000000C92000-memory.dmp

    Filesize

    1.5MB

  • memory/1600-62-0x0000000000B10000-0x0000000000C92000-memory.dmp

    Filesize

    1.5MB

  • memory/1600-64-0x0000000000B10000-0x0000000000C92000-memory.dmp

    Filesize

    1.5MB

  • memory/1600-63-0x0000000000B10000-0x0000000000C92000-memory.dmp

    Filesize

    1.5MB