Analysis

  • max time kernel
    4s
  • max time network
    186s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 23:42 UTC

General

  • Target

    1a748f911b220ae0e03709081cc3ecb8.exe

  • Size

    1.1MB

  • MD5

    1a748f911b220ae0e03709081cc3ecb8

  • SHA1

    77d47314eba656d319e8d5b77c821e3f70884b7e

  • SHA256

    4e9c5457f68e6ee12f75e29e602197feb4df151960dd2cd8a124468788a5df81

  • SHA512

    34933bc78c4a5f92e7149ced0085c02845d96ced515884a2a280c2d2e5d3b11ad9f96ae1a419649102723cb4d7d5400af07d47658e16bad80dcc5016269ce816

  • SSDEEP

    12288:oFc6BxrLx8NZzcuqNPO6JmEtAa4VH/WV6nGTnHbajQZzRLSTo24s+VJDHrMQgR/4:+PGZ+O6JLtAa4VYMGEez0TvYEoH

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a748f911b220ae0e03709081cc3ecb8.exe
    "C:\Users\Admin\AppData\Local\Temp\1a748f911b220ae0e03709081cc3ecb8.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2900

Network

  • flag-us
    DNS
    os.portalprogramascdn.com
    1a748f911b220ae0e03709081cc3ecb8.exe
    Remote address:
    8.8.8.8:53
    Request
    os.portalprogramascdn.com
    IN A
    Response
  • flag-us
    DNS
    kent.dl.sourceforge.net
    Remote address:
    8.8.8.8:53
    Request
    kent.dl.sourceforge.net
    IN A
    Response
  • 82.194.86.133:80
    152 B
    3
  • 82.194.86.133:80
    152 B
    3
  • 8.8.8.8:53
    os.portalprogramascdn.com
    dns
    1a748f911b220ae0e03709081cc3ecb8.exe
    71 B
    144 B
    1
    1

    DNS Request

    os.portalprogramascdn.com

  • 8.8.8.8:53
    kent.dl.sourceforge.net
    dns
    69 B
    128 B
    1
    1

    DNS Request

    kent.dl.sourceforge.net

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\bootstrap_14076.html

    Filesize

    156B

    MD5

    1ea9e5b417811379e874ad4870d5c51a

    SHA1

    a4bd01f828454f3619a815dbe5423b181ec4051c

    SHA256

    f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

    SHA512

    965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\css\main.css

    Filesize

    5KB

    MD5

    a35ca94bb840249c0f3fcc711b6f0cb2

    SHA1

    ceca18ddddee33e1975f9f04b71b6fc4cc31f6b2

    SHA256

    44f4ba01cf1554734b3ab52ffe2bb9192d20c1661b4b17de97c523a2a9f03f9c

    SHA512

    f8cdcf293c6ab2dc32dae366a149efbb86ccb710fdcb4623024e73c3cf23e4efbc515bd3cbc4e19363eb6e22efef4a7bf77718987ee2e076a2969c845f9d99fd

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\css\sdk-ui\progress-bar.css

    Filesize

    506B

    MD5

    5335f1c12201b5f7cf5f8b4f5692e3d1

    SHA1

    13807a10369f7ff9ab3f9aba18135bccb98bec2d

    SHA256

    974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

    SHA512

    0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\Top_Bar.png

    Filesize

    4KB

    MD5

    61a709f859302fc1bad99cf76faa0e1c

    SHA1

    f4943f2058997275a2dc0cb1bcadc59302f52ef5

    SHA256

    e6656ed9574411d1d59595e3f6bccf35106760f7fa48e1f57d2ad59b7cfad510

    SHA512

    599cc37f7d9d587cff397e2bffad9cbd801fac6eb499ec8e74ba3667870e04f01a2cea119f6a8c6deb41ffadfb76f6a8014b5f7864377cabfd281ae1c2805c63

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\badge.png

    Filesize

    4KB

    MD5

    da4c4d7e2d0bf0bf47263fe34b5ba7a4

    SHA1

    d70269a4f56878f00a9646514f688967e62765f6

    SHA256

    4ebdf88d374c06db76dcd1ea960981ba0b67d903c91edc49a9ecef66522d88a8

    SHA512

    731c62ceea286a77574ac71a5e05f883aa536cffa8bc0d7084b3381a8d8ae408e87f360951f8bbb9adfb5338c453a9b9e3f8471bd6634018c02b5e472e56e19b

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\close.png

    Filesize

    365B

    MD5

    69749961b3a71a1d4dea77263085d89f

    SHA1

    f6772a2deedf13860a0e2455c79ea8ea7659af41

    SHA256

    2b70a1fe0d47f3b744c337af1c7803b771b08608de16ee665403e82374f9cf31

    SHA512

    a34cca02d3c3cfe84d5ef943bd95671fcc6461b206e11842bd298c82149110a5a28ac325323511bb2c4ca7d0b0ecdbe3a2c78b8cbbe6207359694ef373459129

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\color_btn.png

    Filesize

    1KB

    MD5

    7478cba40c5f79bc79d640c53ecf4124

    SHA1

    6401ba8b5cbf463175e06c5cb89df1af67235cd7

    SHA256

    d3df7141283079887f6c2cddd0f878b67d24ca8167a413232f7c9cc45e94f7f7

    SHA512

    3b721310d4e687a59a34efb80e6161a5c180ea1e743fc84735c0ab02a10f76c13de87fab1420999046f13936eaec4a7ca5d80402ec1d64a8a1b4a0dd2f2cd7c2

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\content_bg.png

    Filesize

    1KB

    MD5

    3559c0336ac74800ba9ea60ea0ed3a02

    SHA1

    f9cf2b6619afa4ebca369471682dada91a7b002c

    SHA256

    f2813081788cb2573860206ca3208904374aa2ccb00294de0b73e6f955cfc3af

    SHA512

    b4e7c8b5de81c8c13140ea1962048601edaabf23b39a4238b9699d195a2fff18537bba85bc440571bc7a7bf2155732d5e5690e98546f7363337c5932ab5d537c

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\grey_btn.png

    Filesize

    1KB

    MD5

    b85a1e648cc958f295bfd30157bfa118

    SHA1

    5e9a707d4b71422facf2051cd1b44b301fc0b33b

    SHA256

    fe75d2f28e46430cdf1682d410401de75d92d914485e4fc521b943549fd3d764

    SHA512

    de67acf0e937c59de0623c617abb6fca35e85d6e4d72b5b9b9ddce29743f9e1a10aa0cff23ec074284ccec9121ee661d9bfe37ea29e1036f3604bbce79462e8b

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\loader.gif

    Filesize

    21KB

    MD5

    360281e85620142c3329848262da263d

    SHA1

    032ae1e422af859d78d172e918573fb0f55318de

    SHA256

    6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

    SHA512

    48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

  • C:\Users\Admin\AppData\Local\Temp\ish259448835\images\main_bg.png

    Filesize

    4KB

    MD5

    9baa43914a9f8d0d1dd572d7d09a5ed4

    SHA1

    ed963bef6ee88003fd063cb2f6b6913089433927

    SHA256

    e117309d44cd5d673683e44593d8a8c1d9a89afc9ac850c6645f3c7ff8d6a5d5

    SHA512

    c7f5a0789bcc1cf82df75997f9bc18480dcd6454bc43e910bc565d6c75f81d21806b607d054a72234304b5d6ee29a385357d293abc31c9acdb9a20087a773f0b

  • \Users\Admin\AppData\Local\Temp\ICReinstall_1a748f911b220ae0e03709081cc3ecb8.exe

    Filesize

    45KB

    MD5

    0b070896ee1af06418016642b74d6422

    SHA1

    74882f3e78c18d72817e27bad1fb33e840eefb23

    SHA256

    3bb7259997272d9270a9e48d9716ec88e86cbc9494e752a32ce494850160587b

    SHA512

    c434d49a62400e465c2b15c6d5a325d4e35e11c32ce959aa010e8b55e8d4d355afa71aba18b1ca3813e4b13bfc23eaea2c687a1bfce6698b5f35af8ae0e276e2

  • memory/2900-161-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-169-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-0-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-162-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-163-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-164-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2900-165-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-166-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-167-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-1-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2900-170-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-171-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-172-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-173-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-174-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-175-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-176-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2900-177-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.