3d4b2fa0404213e0df9ce86c1118f71c6ed3c5b27a5c4e6729363420fa68d867

Analysis

max time kernel
0s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e71d114ecd5eccf27763996e81ccb58.exe
Size

1.1MB
MD5

3e71d114ecd5eccf27763996e81ccb58
SHA1

51aeef07757272c6f485219a8a7b86ac2cee9bd3
SHA256

3d4b2fa0404213e0df9ce86c1118f71c6ed3c5b27a5c4e6729363420fa68d867
SHA512

02543e0c8d40c29fe9673e3fd00da516ac4e5f41acba8a7630268e6118fd95a04ba8ca548cd7ff73217554e050bcbf94b8533dbf04896a903bb47a1576245092
SSDEEP

24576:vnZaEED47I60ftaBnyGl4JBzTFpuMNExPP2:hiD47L0FHJdTFEMNExP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	3e71d114ecd5eccf27763996e81ccb58.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2928	3e71d114ecd5eccf27763996e81ccb58.exe
2928	3e71d114ecd5eccf27763996e81ccb58.exe

C:\Users\Admin\AppData\Local\Temp\3e71d114ecd5eccf27763996e81ccb58.exe
"C:\Users\Admin\AppData\Local\Temp\3e71d114ecd5eccf27763996e81ccb58.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-79-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2928-27-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-147-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-148-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-149-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-150-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2928-151-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-152-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-153-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-155-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-156-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-157-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-158-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-159-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-160-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-161-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-162-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/2928-163-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download