2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215

Analysis

max time kernel
30s
max time network
124s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe
Size

64KB
MD5

a792d3944bc416e61abdd0a792b60783
SHA1

05e4cc0a70420e873e8706312cc16c45db4ad0cb
SHA256

2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215
SHA512

6c0890cdd846c658388d77d818d48e3892a7e715e1f03151be3301821f6d9b14461aaedb53dc549b308fb75c30275978c3bbf66e958a06fc5aac9c669ed9c3e7
SSDEEP

768:cIzDfb6defIR1Wi62Utyb0dh2p9On8TdaufXgl:Ffb8+IRWL0gdh/niIr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1324	2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe
1324	2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe
1324	2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe
1324	2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe

C:\Users\Admin\AppData\Local\Temp\2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe
"C:\Users\Admin\AppData\Local\Temp\2946b431b438f10ccd56b29c9dd4ed5e6af3b276d6835c9e03c9b0ba772f9215.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads