ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe
Size

2.2MB
MD5

e1036a3e51df5c3e212a33301d24396a
SHA1

2c4adac86aacdade52aef8c48bb92cde19200e5f
SHA256

ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a
SHA512

deb42cff37fcf13634827007b788a626ba22c5ca7bbcc6479e1ef8dbf09d7055905e945ce08fd8d7fc46f3741db25a33e1112994f3a04d51d8e6086120754b2f
SSDEEP

49152:dV5HsmzNfbDkIUQpJYRCN977xhL15iHapnxnQptq2:v5HRNRxh2ExQptZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\TypedURLs	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe
Key created	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5072	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe
5072	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe
5072	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe
5072	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5072	ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe

C:\Users\Admin\AppData\Local\Temp\ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe
"C:\Users\Admin\AppData\Local\Temp\ffb294dacfbb96c7dda2e813f803b5bf3b6cbbcf9d4ab4fe909354c0d451490a.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...