fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22

Analysis

max time kernel
185s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe
Size

5.7MB
MD5

ee65d012e5b479534ef0439097ebd5a0
SHA1

fd52f6e63d829fed2032d631b34910ae62a8e8e3
SHA256

fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22
SHA512

6cd28aa45153cdb44ad363a63ca167adb3a044b084fc3a445b88954cd075c021840b0286c285835a29c79d77b1b39cd3a81e024fdcd42e71353dd7c3b9ea7b47
SSDEEP

98304:Bjian5i7AWjNw9iyt/5Oaltw4BBxTYRfKPQuUE6:vP8Nw9iyt/ttZBzPPLUE6

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3448	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HPSocket4C.dll	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Software\Microsoft\Internet Explorer\TypedURLs	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe
Key created	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3448	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3448	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe
Token: SeIncBasePriorityPrivilege	3448	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3448	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe
3448	fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe

C:\Users\Admin\AppData\Local\Temp\fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe
"C:\Users\Admin\AppData\Local\Temp\fc663b64c848fc3b6d39b985bdc4cb3e577a2cf45969014e29eb50629b467d22.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\HPSocket4C.dll

Filesize
1.7MB

MD5
707aa56cf742eb934185edf0a69d7289

SHA1
dab68976c4bd2d420c8adcd268fc1ffdd5e277e0

SHA256
3582d7ad93c54c2efddac6df4cf7d9e4b2ef1d8895dc9d12a781faf3cfb8bf12

SHA512
8be50ffedd0a250b4519069cec5781a9d0182fe47dce79c1991fc775a9580550c4b512de37e3423dc5d22013dce4cdcb1f178becbf5ef8ccb610c7ccd6d0f54d

Download Submit