90e1ebb52ee92d267e6f97e29e82be04ddb701a4ca5ffcad59dbbcdc608291b6

Analysis

max time kernel
0s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e7eaae1101830915ef7accb64b977a0.exe
Size

1.0MB
MD5

1e7eaae1101830915ef7accb64b977a0
SHA1

9f8ab8d86d7ab159cffb9553e787c52c159595d6
SHA256

90e1ebb52ee92d267e6f97e29e82be04ddb701a4ca5ffcad59dbbcdc608291b6
SHA512

84bbf438ee48b72f554e8a867468c22fe998fd8e848c6bbbbe80b13481a7dd1c7fb1862c9b6785084d31b339c2c96897f9981a302d8c75c9ad6692be73dddff9
SSDEEP

24576:6/QS2mjh4WlPsLm76MkyDHRDcxylpfXrVt3zNS2dxyPb:6/QSjjlmARXfX7DDdx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	1e7eaae1101830915ef7accb64b977a0.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	1e7eaae1101830915ef7accb64b977a0.exe
2092	1e7eaae1101830915ef7accb64b977a0.exe

C:\Users\Admin\AppData\Local\Temp\1e7eaae1101830915ef7accb64b977a0.exe
"C:\Users\Admin\AppData\Local\Temp\1e7eaae1101830915ef7accb64b977a0.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ish259395904\bootstrap_57609.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259395904\css\sdk-ui\browse.css

Filesize
318B

MD5
10c359bc980927bb66b215407ece3e66

SHA1
4a2fc034bf7b4e84d832b6bbd9413d2055b9ec62

SHA256
5b12769a75d1c755a284a73e1b8422f73d6223c23b72e5bce698c17f50185aa8

SHA512
ed707c6bbf5023aa147571d9d186e8348b11da6fb462de69e4135480f2e10081c416c80745411752797401660221e2040e624b5a6d3e1a57ba59cdcc009eb16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259395904\css\sdk-ui\checkbox.css

Filesize
190B

MD5
64773c6b0e3413c81aebc46cce8c9318

SHA1
50f84ef8331341b48981af82313b146863eba526

SHA256
b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d

SHA512
03e96bef74c0b3a31124c3d3c1bb78af1053a8719ca373c6b9316d63bac9545c1f4ecc2d747eb64341d8da31bc0f23da094e19c3e07ed46f65c28dc88e13bd3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish259395904\css\sdk-ui\progress-bar.css

Filesize
632B

MD5
8f6a2e09ace79158461b82d74ff6c7fd

SHA1
88f079fd001feb2cb302565b87fdb81c8995dd93

SHA256
b4bee76334ab9b4b0bdd2bff1b3f3a7b30d2e758bb8d4c6e457c9594bb62960c

SHA512
869305ea12f21564e56882fef318cdc21f88715f894e8140ae6b2cf3137a4c2002a34f2f8ae2719f770e2d0c892244b5e5f3229f1382e799dd309f52657cb98e

Download Submit
memory/2092-144-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2092-149-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-141-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-142-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-143-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2092-145-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-146-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-147-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-0-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-150-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-151-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-152-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-153-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-154-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-155-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-156-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/2092-157-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download