2476b48d6e02ab5884b9e37bd7531f0b72954697aa93be847c7cbb5ab239111f

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3aedea2a5f818317d20db4266bf143e0.exe
Size

816KB
MD5

3aedea2a5f818317d20db4266bf143e0
SHA1

ea598dfa25f231fc5bbe89655a93d9c00c42279d
SHA256

2476b48d6e02ab5884b9e37bd7531f0b72954697aa93be847c7cbb5ab239111f
SHA512

40e5842c6b51fe6abb5369fc53c137ecf8f8790c6da1d0347d46b54664a633970d3a17690173bf5c6ed97c8b0ccf186f9e7caa38e1a2522a4630cb836341c90f
SSDEEP

24576:3pfkL+1vdXMy2D7oROSIuYQ6iwKNHxtht:3pcCj8yKKOqYL+Rh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2164-0-0x0000000001310000-0x0000000001577000-memory.dmp	upx
behavioral1/memory/2164-20-0x0000000001310000-0x0000000001577000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	3aedea2a5f818317d20db4266bf143e0.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	3aedea2a5f818317d20db4266bf143e0.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	3aedea2a5f818317d20db4266bf143e0.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	3aedea2a5f818317d20db4266bf143e0.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2164	3aedea2a5f818317d20db4266bf143e0.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe
2164	3aedea2a5f818317d20db4266bf143e0.exe

C:\Users\Admin\AppData\Local\Temp\3aedea2a5f818317d20db4266bf143e0.exe
"C:\Users\Admin\AppData\Local\Temp\3aedea2a5f818317d20db4266bf143e0.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BDiyjjOBvm\intro_page.html

Filesize
15KB

MD5
60995d04e55f8d138cf5183e95942906

SHA1
d90f51dd6705b94d7d3915dad623f61a7654a410

SHA256
05b3464493d500473e1370aafd8c0b8db1678bd38353237141997607caf5c132

SHA512
3886ba8025d96b3ba1522def75b997aec503505c14ec3364bba93fa8a5509c792b44bc67a9afbfcc4af9047bad69ae7c9dfd61ec094079cf7ddf3838704af871

Download Submit
memory/2164-0-0x0000000001310000-0x0000000001577000-memory.dmp

Filesize
2.4MB

Download
memory/2164-20-0x0000000001310000-0x0000000001577000-memory.dmp

Filesize
2.4MB

Download