3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71

Analysis

max time kernel
93s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71.exe
Size

53KB
MD5

640664c179a19272ddc11fbe76c97410
SHA1

a024c33e00730b47ac49b14b908a48b1af775561
SHA256

3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71
SHA512

44f24d783f831e93d77f4e8e3d9c85b3d9a7a6ced86438d30552f0a7ff6e417130d63163750616e781295ed65fc39f15433cb8fa257a88967830349da0cea3ce
SSDEEP

1536:CyJUWZFvBnjSoZnP4J4kJJER4Romu/IUu6D8Zq:9JUYnjNP4LJJ245zG4Zq

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\µ¼º½\uninst.exe	3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.167w.com"	3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71.exe

C:\Users\Admin\AppData\Local\Temp\3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71.exe
"C:\Users\Admin\AppData\Local\Temp\3d8e0cc3b9d615c9278dcc386d472e3ee5311afb3ce87f12b18325c1e3ef6e71.exe"
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads