08a383141eb26dec74881c34721f9242c9c3de5aa8520512169a0ca2b3ffa424

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1854e1972890eb780b339048b40ccd5f.exe
Size

479KB
MD5

1854e1972890eb780b339048b40ccd5f
SHA1

ed5776d1bcb5cbdcb684f43aa89f55e47f7eee0f
SHA256

08a383141eb26dec74881c34721f9242c9c3de5aa8520512169a0ca2b3ffa424
SHA512

105e726b5bc48b3c2210c32d8238a68a1b28d15f2ec885e4411e24adfcb721d20d56b2d5caa2907fec3c7583ecbb837906124646af83fdd3a009d5569e225179
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2440	1854e1972890eb780b339048b40ccd5f.exe
2440	1854e1972890eb780b339048b40ccd5f.exe
2440	1854e1972890eb780b339048b40ccd5f.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1854e1972890eb780b339048b40ccd5f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	1854e1972890eb780b339048b40ccd5f.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	1854e1972890eb780b339048b40ccd5f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	1854e1972890eb780b339048b40ccd5f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	1854e1972890eb780b339048b40ccd5f.exe
2440	1854e1972890eb780b339048b40ccd5f.exe

C:\Users\Admin\AppData\Local\Temp\1854e1972890eb780b339048b40ccd5f.exe
"C:\Users\Admin\AppData\Local\Temp\1854e1972890eb780b339048b40ccd5f.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_1EA8.tmp\utilities.xml

Filesize
159KB

MD5
01b9f54d1ea0c9effb02d069fab5ffe7

SHA1
416b077b44c0834303003b5ae2b33b9e36d2e5a0

SHA256
6b1b97697dcab08312e9ae4621fd15d3de617b4edea512d0c53ea6c097293372

SHA512
564d8bbf12815a645b798ede97b61d8d86a57ab6dfc3bf97e7abf847008cd18c093b37694a48c49531e9d3848771d435fe4c67f5745e02ebdda78d7beb74736e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImInstaller\IncrediMail\status.xml

Filesize
243B

MD5
c74cc101f96818463168d4c98437507e

SHA1
394129eeed767b675d5db8b588857916571f2169

SHA256
3600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc

SHA512
a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec

Download Submit
\Users\Admin\AppData\Local\Temp\IM_1EA8.tmp\ActionEngine.dll

Filesize
381KB

MD5
1bb6811f826f332266e7a9ec1ecfa028

SHA1
2f3e3c0dbf4453cf0abada24bb79a4859b0415c8

SHA256
8ad2134b189e40d23b0875dee15b9c7698df0dc1eadfb73f6ce3fd450aa97b0e

SHA512
3fcbcde7396a2b7db59b56a0a02f692687ae208d5ac71bf909fe8b9a1cf2b0166601993b2b46b9d9e8027bbf35eda5922d21112eb4493e1d3740f960bd2023c7

Download Submit
memory/2440-109-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download