dc1be31cb3bd6d51fc4c1593797d93bbdfbc246b76d5057c678f6948f7a8405e

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ef21a1f11885f9bf34e06f938dee78a.exe
Size

474KB
MD5

1ef21a1f11885f9bf34e06f938dee78a
SHA1

886a58d8429c6096f615b8d998281f7017baed63
SHA256

dc1be31cb3bd6d51fc4c1593797d93bbdfbc246b76d5057c678f6948f7a8405e
SHA512

8b5ab4d98d2e47d6e15d235b27949350dd7bd08016067049567d123b283ecd8c9739fe058c8b5e37df568377b6d8d4c84317fddea1975f810985c047e85f982b
SSDEEP

12288:C7adqPGOxv6T7Kb774SVAY7IeJAcLdUDBHQItOx0bZ:CBGY6T7Kb7ESDgVHOYZ

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1ef21a1f11885f9bf34e06f938dee78a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	1ef21a1f11885f9bf34e06f938dee78a.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	1ef21a1f11885f9bf34e06f938dee78a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	1ef21a1f11885f9bf34e06f938dee78a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	1ef21a1f11885f9bf34e06f938dee78a.exe
2860	1ef21a1f11885f9bf34e06f938dee78a.exe

C:\Users\Admin\AppData\Local\Temp\1ef21a1f11885f9bf34e06f938dee78a.exe
"C:\Users\Admin\AppData\Local\Temp\1ef21a1f11885f9bf34e06f938dee78a.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...