2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795.exe
Size

4.0MB
MD5

fcd918b5d1a184ca0b290715eae9aa91
SHA1

1f605ed1908f417ee8ba0c38ff3a098ecb625c37
SHA256

2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795
SHA512

50619f62ed650c2ae19f409b58df5c595e48e2ed416d6ca765603e59bc028dcfeb0eb379efc75cb9ec43786a917b88a3a63efb535d8fdb8357e3bfd62be7e7cc
SSDEEP

98304:oCcJJQPGcjPHh/jkr9nsZyqrbfhPDMrZmwFQEFFthHHMTvh2:+JJQuGPHBjc9nsUsbfxDEZmwGEFtBHOo

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1440	2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795.exe
1440	2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795.exe

C:\Users\Admin\AppData\Local\Temp\2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795.exe
"C:\Users\Admin\AppData\Local\Temp\2c648d6f2888f12d2ec6a00340e0ca7a22859dec2b3f02e06afb7814110c9795.exe"
1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download