1a8b02a00ef4d9bd3ab1aaa0c3a02f42e5c0668ef3ca58bde3d9187e10a553d4

Analysis

max time kernel
141s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c9e7906d0ad5d0f2267be0057f2a8e3.exe
Size

566KB
MD5

8c9e7906d0ad5d0f2267be0057f2a8e3
SHA1

e47a5b8f29420c27a32571dee9e395e7f9bcdd71
SHA256

1a8b02a00ef4d9bd3ab1aaa0c3a02f42e5c0668ef3ca58bde3d9187e10a553d4
SHA512

b1f4195a1f29e2dfdc2d1bd178cb5ca13d0969c6d031e9d82fc158c1953d472442c7a4ef8d02e0d1f6f4d1c7448ce861192e26ce08ae670129156ab754ee754d
SSDEEP

12288:VeySN3iCEg3MkmvlBT49xQP77gKyfZfozGQirA+:Vey4mvlBT49xi7MKUZfozE1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2608-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/2608-13-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	8c9e7906d0ad5d0f2267be0057f2a8e3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	8c9e7906d0ad5d0f2267be0057f2a8e3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	8c9e7906d0ad5d0f2267be0057f2a8e3.exe
2608	8c9e7906d0ad5d0f2267be0057f2a8e3.exe

C:\Users\Admin\AppData\Local\Temp\8c9e7906d0ad5d0f2267be0057f2a8e3.exe
"C:\Users\Admin\AppData\Local\Temp\8c9e7906d0ad5d0f2267be0057f2a8e3.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2608-2-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/2608-1-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/2608-3-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/2608-13-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2608-15-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download
memory/2608-16-0x00000000002D0000-0x00000000002F2000-memory.dmp

Filesize
136KB

Download