790094c3cde00f923535ad5181b5711cbca010eae9fc37c31c671525d55b5a0f

Analysis

max time kernel
165s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

055d2610f7c84b12732fd60a2a0e5f40.exe
Size

805KB
MD5

055d2610f7c84b12732fd60a2a0e5f40
SHA1

65500567f00cad53b1766018abe73297b3f01576
SHA256

790094c3cde00f923535ad5181b5711cbca010eae9fc37c31c671525d55b5a0f
SHA512

3d6ec9dd57848ffeb485bc1c7542693cb0464d41e66c1647df9b2310488d989660eb607a13cd27bf6a126f67a0784adbdaf43eb2a757d69bbcc32cdbec17129c
SSDEEP

24576:SeF1NitjvnxlGdxgYTAzxPG8VQb8bRRS:SeF1NQvnxlmgvzxu8VQbYR8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\International\CpMRU	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	055d2610f7c84b12732fd60a2a0e5f40.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\IESettingSync	055d2610f7c84b12732fd60a2a0e5f40.exe
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	055d2610f7c84b12732fd60a2a0e5f40.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "055d2610f7c84b12732fd60a2a0e5f40.MyNSHandler"	055d2610f7c84b12732fd60a2a0e5f40.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	055d2610f7c84b12732fd60a2a0e5f40.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\055d2610f7c84b12732fd60a2a0e5f40.exe"	055d2610f7c84b12732fd60a2a0e5f40.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\055d2610f7c84b12732fd60a2a0e5f40.MyNSHandler	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\055d2610f7c84b12732fd60a2a0e5f40.MyNSHandler\ = "this is my ebook"	055d2610f7c84b12732fd60a2a0e5f40.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\055d2610f7c84b12732fd60a2a0e5f40.MyNSHandler\Clsid	055d2610f7c84b12732fd60a2a0e5f40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\055d2610f7c84b12732fd60a2a0e5f40.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	055d2610f7c84b12732fd60a2a0e5f40.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	055d2610f7c84b12732fd60a2a0e5f40.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1524	055d2610f7c84b12732fd60a2a0e5f40.exe
1524	055d2610f7c84b12732fd60a2a0e5f40.exe

C:\Users\Admin\AppData\Local\Temp\055d2610f7c84b12732fd60a2a0e5f40.exe
"C:\Users\Admin\AppData\Local\Temp\055d2610f7c84b12732fd60a2a0e5f40.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-0-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/1524-1-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1524-3-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download