75fb901e00757e5544cab7b6dc4f325cfbe8503ade5de1de5f53fbce5ee12449

Analysis

max time kernel
200s
max time network
224s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

104b6144a9b1dc492b1bc7868c07aef4.exe
Size

159KB
MD5

104b6144a9b1dc492b1bc7868c07aef4
SHA1

77d11404e2323ed95f299305cefa422f2b0a009c
SHA256

75fb901e00757e5544cab7b6dc4f325cfbe8503ade5de1de5f53fbce5ee12449
SHA512

5bbb52f729f47fea59c49dbd12c9c9545f47732180022fba8b72ce81695764c8947921a0ee5ef4606e6d54e6bdbc11a5d81591927684affc529304d5aed0bfad
SSDEEP

3072:c+1z6IkSvOVLx4LINvr7Qk8f6NqcJJ4AqAGsjKAC5LgFB:ccuIrO5xD1r6c45

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1920	Iguzya.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	Iguzya.exe
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	104b6144a9b1dc492b1bc7868c07aef4.exe
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	104b6144a9b1dc492b1bc7868c07aef4.exe
File created	C:\Windows\Iguzya.exe	104b6144a9b1dc492b1bc7868c07aef4.exe
File opened for modification	C:\Windows\Iguzya.exe	104b6144a9b1dc492b1bc7868c07aef4.exe
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	Iguzya.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International	Iguzya.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2768	104b6144a9b1dc492b1bc7868c07aef4.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe
1920	Iguzya.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2768	104b6144a9b1dc492b1bc7868c07aef4.exe
1920	Iguzya.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 1920	2768	104b6144a9b1dc492b1bc7868c07aef4.exe	29
PID 2768 wrote to memory of 1920	2768	104b6144a9b1dc492b1bc7868c07aef4.exe	29
PID 2768 wrote to memory of 1920	2768	104b6144a9b1dc492b1bc7868c07aef4.exe	29
PID 2768 wrote to memory of 1920	2768	104b6144a9b1dc492b1bc7868c07aef4.exe	29

C:\Users\Admin\AppData\Local\Temp\104b6144a9b1dc492b1bc7868c07aef4.exe
"C:\Users\Admin\AppData\Local\Temp\104b6144a9b1dc492b1bc7868c07aef4.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\Iguzya.exe
  C:\Windows\Iguzya.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Iguzya.exe

Filesize
159KB

MD5
104b6144a9b1dc492b1bc7868c07aef4

SHA1
77d11404e2323ed95f299305cefa422f2b0a009c

SHA256
75fb901e00757e5544cab7b6dc4f325cfbe8503ade5de1de5f53fbce5ee12449

SHA512
5bbb52f729f47fea59c49dbd12c9c9545f47732180022fba8b72ce81695764c8947921a0ee5ef4606e6d54e6bdbc11a5d81591927684affc529304d5aed0bfad

Download Submit
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Filesize
344B

MD5
01ee3da67b4b9a51afceac01d061d89e

SHA1
c200347e03f39e4571a407af86e83d80ac1dd713

SHA256
5cc704dea9f2708ef6539d7fa6300faab2f54d8965c92c5a007df9d365510609

SHA512
cda31a262fda3c74d4bd46cdee71dce170d728c25d643a1ffa2e328303f685e15ebd951f10ed83974f67cb8f84525480ba009438e215e13ce8e1e13afcab5745

Download Submit
memory/1920-23-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-20-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-20375-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-41250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-41251-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-41252-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1920-41253-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-19-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-0-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download