a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd

Analysis

max time kernel
76s
max time network
135s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd.exe
Size

1.5MB
MD5

88e77bfa819d0ab40876311fe7fcb6c3
SHA1

1e8d18d1d87fade0de5a3a873bc967729b51ddaf
SHA256

a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd
SHA512

1b0164f7754552e6cb84133dd6d3cf2d57f5eac49b2eac2fd69d1a86e691f7409f94255dd6a94cf8b3ed49575081162c4cdc44761b43dddb76a8a31508326d8e
SSDEEP

24576:mhRrCsqgh62GVwFSA2FsQYTf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY0:mh8sEMScQYr+s8KuqGaX0ToIBAUZLY0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TypedURLs	a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1152	a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd.exe
1152	a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd.exe
1152	a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd.exe

C:\Users\Admin\AppData\Local\Temp\a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd.exe
"C:\Users\Admin\AppData\Local\Temp\a8418876ebab5711ace69fab9b62c5db06f8145c7f9e247c943d3525bfd483cd.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download