e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5

Analysis

max time kernel
80s
max time network
139s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
Size

480KB
MD5

78709dfdca27ecf28ff2dec3e064ab11
SHA1

373633f1bdf313a499517f10589dccad364c7866
SHA256

e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5
SHA512

8fe6931f9a52e0090c5023a3631d8b65b3e117fb5b8999b4eee86bdc2d1469ba3e42ac1e586ff482d3223f4ba45e250f64fc83018720f3a7cf03e4454b41f894
SSDEEP

6144:Yi8hHs9VYUJYoPOTSnT4dlG4G10AhJt2vnbqqDLuTnH:IhHs9aQYoPOTBdlG4G106qnubH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\LiuLiangZB = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe\" /autorun"	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

pid	process
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

pid	process
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

pid	process
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
748	e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe

C:\Users\Admin\AppData\Local\Temp\e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe
"C:\Users\Admin\AppData\Local\Temp\e6df2767c88b064d5886e5f0969fbcf80884c192d6d06466c42cc3af47689bd5.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download