a54771b755c8724180d609a83fb513ee477f6b0eef0374d92044213d89a3272e

Analysis

max time kernel
121s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34ba58fca59d5fa94dca9f281bc52659.exe
Size

260KB
MD5

34ba58fca59d5fa94dca9f281bc52659
SHA1

7e689078319ce02c84030e4256ffe1ce0f050d11
SHA256

a54771b755c8724180d609a83fb513ee477f6b0eef0374d92044213d89a3272e
SHA512

b096cf6f2bdb97295252f32141b7ca58f4cd99e85f8c70c3fc3b3cb7d0b1236aa069ca8b6313c0602133f431679bd0bae51701f3c48433367aacaf3fe83e61ae
SSDEEP

6144:GCiSX4gc9mphwHFlI+/iCtskUyJMfI0+HMm7Z4o:eSXJcEphGFf/i/aJW+sm7Z

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft\test.log	34ba58fca59d5fa94dca9f281bc52659.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	34ba58fca59d5fa94dca9f281bc52659.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	34ba58fca59d5fa94dca9f281bc52659.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	34ba58fca59d5fa94dca9f281bc52659.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\IESettingSync	34ba58fca59d5fa94dca9f281bc52659.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1592	34ba58fca59d5fa94dca9f281bc52659.exe
1592	34ba58fca59d5fa94dca9f281bc52659.exe
1592	34ba58fca59d5fa94dca9f281bc52659.exe
1592	34ba58fca59d5fa94dca9f281bc52659.exe

C:\Users\Admin\AppData\Local\Temp\34ba58fca59d5fa94dca9f281bc52659.exe
"C:\Users\Admin\AppData\Local\Temp\34ba58fca59d5fa94dca9f281bc52659.exe"
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...