dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
26/11/2023, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe
Size

6.4MB
MD5

8a44242dbcda697c92f5122d741c8e81
SHA1

d9f06fc1e615dd84ff9e9b6b0d4e1a73097bfdc3
SHA256

dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d
SHA512

2413fd998c6b74c95eb075046f068e41e5a1c4b048efbb81568bd1091e0cbadb51249b50ea254099970b0660a38827670b9a6a06cc9136c9e7e9d9300ab6916a
SSDEEP

196608:v+kkpLp5JPXWI8xvvg8VFLDmy2PNKS1s9bukK0N+H:vNCt/atgQFLiNns4kKIY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2700	WinRAR64.exe
1204	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
768	dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe
768	dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	WinRAR64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	WinRAR64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	WinRAR64.exe
2700	WinRAR64.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2700	768	dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe	28
PID 768 wrote to memory of 2700	768	dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe	28
PID 768 wrote to memory of 2700	768	dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe	28
PID 768 wrote to memory of 2700	768	dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe	28

C:\Users\Admin\AppData\Local\Temp\dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe
"C:\Users\Admin\AppData\Local\Temp\dea03c3b7e1fbf43be62fc06b66bb0103f367fc96395d1feb876ca95a2a51e9d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:768
- C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR64.exe
  "C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR64.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR64.exe

Filesize
3.6MB

MD5
34d4563ab756a68c32776a376dbdda69

SHA1
5b4248cd5dbdea49d4a7f4b0751c5bc9650bc45d

SHA256
4971ef6b12162b9487d43e581a62eaed34e037f4f67311a1915c9a41758fe090

SHA512
3d8e4ea55f49321b89b9fbc47c58c2b06ebd106a79e2c7d0a47d3968ffdc1c7eea1a8b6433b988803026b4c2629587d7d85abae68d14b27631f606480be763c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR64.exe

Filesize
3.6MB

MD5
34d4563ab756a68c32776a376dbdda69

SHA1
5b4248cd5dbdea49d4a7f4b0751c5bc9650bc45d

SHA256
4971ef6b12162b9487d43e581a62eaed34e037f4f67311a1915c9a41758fe090

SHA512
3d8e4ea55f49321b89b9fbc47c58c2b06ebd106a79e2c7d0a47d3968ffdc1c7eea1a8b6433b988803026b4c2629587d7d85abae68d14b27631f606480be763c1

Download Submit
\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR64.exe

Filesize
3.6MB

MD5
34d4563ab756a68c32776a376dbdda69

SHA1
5b4248cd5dbdea49d4a7f4b0751c5bc9650bc45d

SHA256
4971ef6b12162b9487d43e581a62eaed34e037f4f67311a1915c9a41758fe090

SHA512
3d8e4ea55f49321b89b9fbc47c58c2b06ebd106a79e2c7d0a47d3968ffdc1c7eea1a8b6433b988803026b4c2629587d7d85abae68d14b27631f606480be763c1

Download Submit
\Users\Admin\AppData\Local\Temp\WinRAR\WinRAR64.exe

Filesize
3.6MB

MD5
34d4563ab756a68c32776a376dbdda69

SHA1
5b4248cd5dbdea49d4a7f4b0751c5bc9650bc45d

SHA256
4971ef6b12162b9487d43e581a62eaed34e037f4f67311a1915c9a41758fe090

SHA512
3d8e4ea55f49321b89b9fbc47c58c2b06ebd106a79e2c7d0a47d3968ffdc1c7eea1a8b6433b988803026b4c2629587d7d85abae68d14b27631f606480be763c1

Download Submit
\Users\Admin\AppData\Local\Temp\nsd9233.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit