b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113

Analysis

max time kernel
133s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe
Size

58KB
MD5

0bd37f147bef80274e0348642bfcdd0f
SHA1

5c8715f7107b5f346ad79d7200de6c5e04b32030
SHA256

b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113
SHA512

5415a2bac6bb9d20c7e9afb309128c07f4d59b131a2a6cfe9e669e678c65cfba640d432461b8e643be30c10dbd732138071e6d4933e6247ec373e4f459f42a57
SSDEEP

1536:NB+nu9b3kc74UHshmP+fy9WWvofqmo2Wt:Neu9b317BsheNAa2q

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LvbdhfngZLBYWOaN+KCM1MYK9 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe"	b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LvbdhfngZLBYWOaN+KCM1MYK9 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe"	b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\PopupMgr = "yes"	b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe

C:\Users\Admin\AppData\Local\Temp\b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe
"C:\Users\Admin\AppData\Local\Temp\b87a0e657de4bfcfa18fc79fdee86a063ba1a799c6de547843a6b94fecb4c113.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-132-0x00000000004F0000-0x00000000004FB000-memory.dmp

Filesize
44KB

Download
memory/1536-133-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download
memory/1536-134-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1536-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads