2cbfe0b788dc4f1cd701dcfd16eea83f685c1d27e67a1497a447e481d7d2766b

Analysis

max time kernel
0s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a5bf88fd8cdd9fb2aeb1396a43d7cc3.exe
Size

880KB
MD5

3a5bf88fd8cdd9fb2aeb1396a43d7cc3
SHA1

18b24087beb39afc9473f5ddc95b720904f0d293
SHA256

2cbfe0b788dc4f1cd701dcfd16eea83f685c1d27e67a1497a447e481d7d2766b
SHA512

22b708d84cf5ae3f104dc382b6fc3a0b85cf12d9ed766599f6afc5489a1e703d48b8f5338548574743179a514025daffd1506ad940afac8ce43e851f565ebea2
SSDEEP

24576:Y+YRcMvGkW60y+QtpiO16UYrxc6jGPX2GxPlk:YrRpvbWsiOMUi36eGxP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2872-0-0x0000000000400000-0x00000000006B4000-memory.dmp	upx
behavioral1/memory/2872-7-0x0000000000400000-0x00000000006B4000-memory.dmp	upx
behavioral1/memory/2872-23-0x0000000000400000-0x00000000006B4000-memory.dmp	upx
behavioral1/memory/2872-145-0x0000000000400000-0x00000000006B4000-memory.dmp	upx
behavioral1/memory/2872-146-0x0000000000400000-0x00000000006B4000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	3a5bf88fd8cdd9fb2aeb1396a43d7cc3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2872	3a5bf88fd8cdd9fb2aeb1396a43d7cc3.exe
2872	3a5bf88fd8cdd9fb2aeb1396a43d7cc3.exe

C:\Users\Admin\AppData\Local\Temp\3a5bf88fd8cdd9fb2aeb1396a43d7cc3.exe
"C:\Users\Admin\AppData\Local\Temp\3a5bf88fd8cdd9fb2aeb1396a43d7cc3.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/2872-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2872-7-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/2872-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2872-23-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/2872-145-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download
memory/2872-146-0x0000000000400000-0x00000000006B4000-memory.dmp

Filesize
2.7MB

Download