74493b3aa75e7ef7216145fb7a2a0a01ec92df4275dc69959b38d8ca75fac934

Analysis

max time kernel
94s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51bd9be28000329f491cb90ed4085bf3.exe
Size

479KB
MD5

51bd9be28000329f491cb90ed4085bf3
SHA1

dc44137075dde6881eaf32bc001c8dc99fd3c998
SHA256

74493b3aa75e7ef7216145fb7a2a0a01ec92df4275dc69959b38d8ca75fac934
SHA512

54c77e03816b1f51fd3960b00396f322a2dbcbb40ab9f3f9d0512fed51cf2095b0f9c9b7cdf29bae243bb2349c0169715c7ffa718dc3dd954476c0540794f55b
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1940	51bd9be28000329f491cb90ed4085bf3.exe
1940	51bd9be28000329f491cb90ed4085bf3.exe
1940	51bd9be28000329f491cb90ed4085bf3.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	51bd9be28000329f491cb90ed4085bf3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	51bd9be28000329f491cb90ed4085bf3.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	51bd9be28000329f491cb90ed4085bf3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	51bd9be28000329f491cb90ed4085bf3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1940	51bd9be28000329f491cb90ed4085bf3.exe
1940	51bd9be28000329f491cb90ed4085bf3.exe

C:\Users\Admin\AppData\Local\Temp\51bd9be28000329f491cb90ed4085bf3.exe
"C:\Users\Admin\AppData\Local\Temp\51bd9be28000329f491cb90ed4085bf3.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_2BB2.tmp\instlangs.xml

Filesize
17KB

MD5
aa91818150cfadb667ae6f914d43dca0

SHA1
4411bd0038ccd464ed7597f0540cfe04867b9042

SHA256
2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5

SHA512
dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_2BB2.tmp\utilities.xml

Filesize
92KB

MD5
0e6ba2787714e905adcc233c115b820e

SHA1
5c87b06dbdf6a1e1d9d4591131f97d3dd7756470

SHA256
2196ef61f9a2ee3ef2e3ba0e73f02271b4ce058dcf26bfbc5de533b5938a9bee

SHA512
126478cdac7dd7e4198634b96d41dcb926e1afeb63059a514c6780e708e61884563fe7c152dc11208ae893c1558776c60645772e787bc3fda44a3a5704406d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImInstaller\IncrediMail\status.xml

Filesize
243B

MD5
c74cc101f96818463168d4c98437507e

SHA1
394129eeed767b675d5db8b588857916571f2169

SHA256
3600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc

SHA512
a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec

Download Submit
\Users\Admin\AppData\Local\Temp\IM_2BB2.tmp\ActionEngine.dll

Filesize
95KB

MD5
d6d0ad4aea4c79df9807d745cdd02d6f

SHA1
26e8f66d8aa8b29060ae2d3dc9114e9a493e55dc

SHA256
371945ada332606ea99a6d7f98e98e4e3904af76c871ff0b3e7b64480f51744f

SHA512
22f3ba0cc38e2abb72379e9b62aa5447381ebf0202651afe706e4a238ebb38e462a7175aa058172c6869acca3e524e2016f6c79649d9a23e051d4c59d7d3fd7d

Download Submit
\Users\Admin\AppData\Local\Temp\IM_2BB2.tmp\ActionEngine.dll

Filesize
92KB

MD5
d5bf464233734dfa7f63993efa232f84

SHA1
7413b7d8bb73bc6f127319c81c93d01fe31a7ed2

SHA256
c1558470b5929a3ca418c53ffe9e6a179bbf244c1e3014ec8f436528bc318a49

SHA512
4cdcad5d008db4da53895f560003a47a4497474a03e335ec30b49a8ef53559cc5640623e65f7fe6ae11acc70b699c34bf37129dcfc0d0175b54059c6ea8e0387

Download Submit
\Users\Admin\AppData\Local\Temp\IM_2BB2.tmp\ActionEngine.dll

Filesize
381KB

MD5
1bb6811f826f332266e7a9ec1ecfa028

SHA1
2f3e3c0dbf4453cf0abada24bb79a4859b0415c8

SHA256
8ad2134b189e40d23b0875dee15b9c7698df0dc1eadfb73f6ce3fd450aa97b0e

SHA512
3fcbcde7396a2b7db59b56a0a02f692687ae208d5ac71bf909fe8b9a1cf2b0166601993b2b46b9d9e8027bbf35eda5922d21112eb4493e1d3740f960bd2023c7

Download Submit
memory/1940-106-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download