41acabae83bee973d09be9fea79adeb9c6b3cf10c6181959b249552e8ca6819c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d21db67b838d1c4b6fa2374f6b3b918.exe
Size

479KB
MD5

2d21db67b838d1c4b6fa2374f6b3b918
SHA1

688df05fbaa0f58aca760d5e0d97530a9e7503f7
SHA256

41acabae83bee973d09be9fea79adeb9c6b3cf10c6181959b249552e8ca6819c
SHA512

b873a60525b2c27a981b26f124ebe2003d3ada538601ba9000ba19e3d35090225b1c8b9f419f692985280f9b253de127d7ba41b89b581f2ff6b2f9f0a7da84af
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2184	2d21db67b838d1c4b6fa2374f6b3b918.exe
2184	2d21db67b838d1c4b6fa2374f6b3b918.exe
2184	2d21db67b838d1c4b6fa2374f6b3b918.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2d21db67b838d1c4b6fa2374f6b3b918.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	2d21db67b838d1c4b6fa2374f6b3b918.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	2d21db67b838d1c4b6fa2374f6b3b918.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	2d21db67b838d1c4b6fa2374f6b3b918.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2184	2d21db67b838d1c4b6fa2374f6b3b918.exe
2184	2d21db67b838d1c4b6fa2374f6b3b918.exe

C:\Users\Admin\AppData\Local\Temp\2d21db67b838d1c4b6fa2374f6b3b918.exe
"C:\Users\Admin\AppData\Local\Temp\2d21db67b838d1c4b6fa2374f6b3b918.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_2607.tmp\utilities.xml

Filesize
159KB

MD5
01b9f54d1ea0c9effb02d069fab5ffe7

SHA1
416b077b44c0834303003b5ae2b33b9e36d2e5a0

SHA256
6b1b97697dcab08312e9ae4621fd15d3de617b4edea512d0c53ea6c097293372

SHA512
564d8bbf12815a645b798ede97b61d8d86a57ab6dfc3bf97e7abf847008cd18c093b37694a48c49531e9d3848771d435fe4c67f5745e02ebdda78d7beb74736e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImInstaller\IncrediMail\status.xml

Filesize
243B

MD5
c74cc101f96818463168d4c98437507e

SHA1
394129eeed767b675d5db8b588857916571f2169

SHA256
3600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc

SHA512
a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec

Download Submit
\Users\Admin\AppData\Local\Temp\IM_2607.tmp\ActionEngine.dll

Filesize
490KB

MD5
e9655b4a36f0d757ff4aee6b837fce0f

SHA1
be000caaa9953ecbdc01e11286bc09b0c3870df3

SHA256
810190f9df25d7eb97e540695b9b390a16ac371d9e64e47163668246b6f6e1a8

SHA512
586ce08af6880837499140d9702abc48f61c2aa822041577b3f3480bc4808fc9ad42fa99ed475dd501bd4a900b811aac19413b7007d47542fc3bd955c2e9eb24

Download Submit
\Users\Admin\AppData\Local\Temp\IM_2607.tmp\ActionEngine.dll

Filesize
1009KB

MD5
9f33f5afe6693f5ef2bab1ff9b68ca52

SHA1
01b12b2c2b389d2337548b6d41a11be4516d8039

SHA256
7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced

SHA512
221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad

Download Submit
memory/2184-103-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2184-177-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download