09b39773fdb625e13fc03f87d3771bda16616a20e244c21171d947030a7a7829

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5977b8147d6570f57a242e92984d3dec.exe
Size

479KB
MD5

5977b8147d6570f57a242e92984d3dec
SHA1

37ed74cf5cb5da357c61edb929ff7d596125f6a6
SHA256

09b39773fdb625e13fc03f87d3771bda16616a20e244c21171d947030a7a7829
SHA512

6229de012521005877ce2e6efaaa31a99a1bc64ea0afebcba745cbb2c3b2b822d1101ff0dfc01c8b781a177aa5a16920f5c3373431d59e5e30dc0cbb92ea3703
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2148	5977b8147d6570f57a242e92984d3dec.exe
2148	5977b8147d6570f57a242e92984d3dec.exe
2148	5977b8147d6570f57a242e92984d3dec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5977b8147d6570f57a242e92984d3dec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	5977b8147d6570f57a242e92984d3dec.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	5977b8147d6570f57a242e92984d3dec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	5977b8147d6570f57a242e92984d3dec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2148	5977b8147d6570f57a242e92984d3dec.exe
2148	5977b8147d6570f57a242e92984d3dec.exe

C:\Users\Admin\AppData\Local\Temp\5977b8147d6570f57a242e92984d3dec.exe
"C:\Users\Admin\AppData\Local\Temp\5977b8147d6570f57a242e92984d3dec.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_1D12.tmp\utilities.xml

Filesize
159KB

MD5
01b9f54d1ea0c9effb02d069fab5ffe7

SHA1
416b077b44c0834303003b5ae2b33b9e36d2e5a0

SHA256
6b1b97697dcab08312e9ae4621fd15d3de617b4edea512d0c53ea6c097293372

SHA512
564d8bbf12815a645b798ede97b61d8d86a57ab6dfc3bf97e7abf847008cd18c093b37694a48c49531e9d3848771d435fe4c67f5745e02ebdda78d7beb74736e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImInstaller\IncrediMail\status.xml

Filesize
243B

MD5
c74cc101f96818463168d4c98437507e

SHA1
394129eeed767b675d5db8b588857916571f2169

SHA256
3600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc

SHA512
a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec

Download Submit
\Users\Admin\AppData\Local\Temp\IM_1D12.tmp\ActionEngine.dll

Filesize
1009KB

MD5
9f33f5afe6693f5ef2bab1ff9b68ca52

SHA1
01b12b2c2b389d2337548b6d41a11be4516d8039

SHA256
7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced

SHA512
221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad

Download Submit
memory/2148-103-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2148-177-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download