53e090e0692dd5d7de6757b94fef4f6b84405cdbf80acd1cf4fc66fba51bf6d3

Analysis

max time kernel
6s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe
Size

479KB
MD5

1a7b04ccf6d4f3dd008ecf71fe2f1ef9
SHA1

f862ab5adce8dea5583e474f79b16f2d7fdf98b9
SHA256

53e090e0692dd5d7de6757b94fef4f6b84405cdbf80acd1cf4fc66fba51bf6d3
SHA512

cb665d70558149251969be5bf2c262cec4cbfd982dca9751d166d7f2a585be16b1caec685fbe08790701c71510f94db34aadf21977d36fd18baa4a86f5e38acc
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2672	1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe
2672	1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe

C:\Users\Admin\AppData\Local\Temp\1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe
"C:\Users\Admin\AppData\Local\Temp\1a7b04ccf6d4f3dd008ecf71fe2f1ef9.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\ActionEngine.dll

Filesize
112KB

MD5
461ad5cea692d0b389ecc4b214db5f33

SHA1
c9b53b7fc14fbe6540d1c060d63023349e0c15ff

SHA256
073ca2abae9859b9a681beb457a7c8b553b8898c95477e95e0ff050ae71d07ec

SHA512
2680592100aefb65449f10c8b8d5c9e52ea9c5b3c861061f4a2b6c54dcab3feccbd8f318784e15b2a3d4de1f13bd1951956ba74789a5d67a0e61984a8896bfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\Gui\api.js

Filesize
5KB

MD5
cad20144ce29f20fecd6c21c5c61dead

SHA1
6bbaeb0aae32a3828cb77f8bfd3fb493803f3626

SHA256
e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80

SHA512
35e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\Gui\jquery-1.3.2.min.js

Filesize
55KB

MD5
bb381e2d19d8eace86b34d20759491a5

SHA1
3dc9f7c2642efff4482e68c9d9df874bf98f5bcb

SHA256
c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899

SHA512
abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\Gui\jquery.localisation.min.js

Filesize
1KB

MD5
f1cf73e00c240e9a4283201291d45a07

SHA1
918c49cb6f1de521d91967b2508f19db1f38fea2

SHA256
81bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2

SHA512
2242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\Gui\language\splash-strings.js

Filesize
446B

MD5
157d5a5389521369e8d42bf50dd9e4e5

SHA1
32f0877615d73dd0f952dbaf1425e2e61e8082aa

SHA256
5688c7509f409b9f06d40f247000833f8318e4d20dbb6a2dff7fdb74df220bed

SHA512
75a583cfa7bd4fb4eaa73b3e189a5dba4116479c5ac5c6be8db95bb656b3951013493ada964d8abf4d5140732ae3e0e1e09e9f48622d445460532ec8eef06f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\Gui\splash.html

Filesize
1KB

MD5
0d0e0532f51af856688ad83abb889fde

SHA1
a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c

SHA256
a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8

SHA512
29322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\Gui\splash.js

Filesize
946B

MD5
354dce57695e99df9e6faba76346496f

SHA1
ca364e2daa4a80cfed7412b0f0374f1f82fa7146

SHA256
bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823

SHA512
8f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\Gui\translation.js

Filesize
6KB

MD5
682fea27f4c335defc18be6fb24d5748

SHA1
d4a1743d63508d18af4be59232f3d266228648fb

SHA256
928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f

SHA512
ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\instlangs.xml

Filesize
17KB

MD5
aa91818150cfadb667ae6f914d43dca0

SHA1
4411bd0038ccd464ed7597f0540cfe04867b9042

SHA256
2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5

SHA512
dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\utilities.xml

Filesize
5KB

MD5
2557133053fae1170d26d9a292301491

SHA1
d085f5962fd57d31bc1d0d90f7daaa6044b30e46

SHA256
b412e0d8dd353369c5bc48ac0b4e4d86d708571b7fdc707e42e795bf650630b5

SHA512
48509d71dc5ed0c759d6d5a6bfe9880891871403304954b6e73751271d0bdbcb5bf5b3bb83a7858044685b7cb9ca09931626bd53b30041df497ed08b5cb10799

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImInstaller\IncrediMail\status.xml

Filesize
243B

MD5
c74cc101f96818463168d4c98437507e

SHA1
394129eeed767b675d5db8b588857916571f2169

SHA256
3600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc

SHA512
a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec

Download Submit
\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\ActionEngine.dll

Filesize
12KB

MD5
a5590c6de34e66f7f34402c3816bbe1a

SHA1
2c46b39ae1172e0eb2a4425d0d3a164938328a6c

SHA256
70137911a33ba661ccdbd4c51416423e77bb4efdbcf46c126895769ffcd40167

SHA512
40745ff98f53cacaa7e5f00c628476328399ac9555b9d8a4d46766f92f112fad8d4c854869e1a36905b7cac089bee64b6a3270a548662c98f98ba52f6175dca4

Download Submit
\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\ActionEngine.dll

Filesize
10KB

MD5
f9f1d4a4d6ed766d989f4e0df47f4e32

SHA1
a5ff3c86caa9a57ab484e702e563e6165be8825b

SHA256
f8536263da4d4f4c18e40b31c5208fb9d551430c2bd89ea39b2550191caf1dd9

SHA512
f2472751db21b0a1ba3d1775e4267eb6315fb173924ff6dbe9a34967dbd30393b1f4234fd6d3ada2ec5af38b41bec821813d4629588b5e8a82a5512781583b61

Download Submit
\Users\Admin\AppData\Local\Temp\IM_6A19.tmp\ActionEngine.dll

Filesize
101KB

MD5
6a9081f8d978f0a1889bb79ca212f781

SHA1
6fd5896f51a7d7fce205862c5fabaf6c0a78530e

SHA256
c42463e174c18d4e1800ef36315537a12f7699fe137c077456087164439e1f18

SHA512
1e256013f03e46e2447f08bed8d46bd0ea4327cb8840d3c5be8cab789ebc96c7115b093b023885e171f3a36b8ae018ed771e0c1f8fc38b977d2cf7b202f100bc

Download Submit
memory/2672-161-0x0000000004CC0000-0x0000000004CE0000-memory.dmp

Filesize
128KB

Download
memory/2672-181-0x0000000004CC0000-0x0000000004CE0000-memory.dmp

Filesize
128KB

Download
memory/2672-180-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/2672-162-0x0000000004CC0000-0x0000000004CE0000-memory.dmp

Filesize
128KB

Download
memory/2672-163-0x0000000004CC0000-0x0000000004CE0000-memory.dmp

Filesize
128KB

Download
memory/2672-103-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download