546790e463b49506644f240596d3428963030c8cf1c415e731a593490aaa5ff4

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a9493ee7bb582d06c5bc71fc6759836.exe
Size

123KB
MD5

5a9493ee7bb582d06c5bc71fc6759836
SHA1

b536baea0395badf99d3ad83625c114a469854f0
SHA256

546790e463b49506644f240596d3428963030c8cf1c415e731a593490aaa5ff4
SHA512

4279da123e17b83af0ed9c3e4940bac5fa26c591cfd900a2b8585e089c622857a3b7edcee6fd0400305e8fdc5eae67679e5de490c7427f1045171c722549a7ad
SSDEEP

3072:X6T4NzW0Jo5kVAljMvZyFdRMIw9EFtXgrJ:qT+W0J+xQsRMFiP

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	5a9493ee7bb582d06c5bc71fc6759836.exe
File opened for modification	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	5a9493ee7bb582d06c5bc71fc6759836.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\Main	5a9493ee7bb582d06c5bc71fc6759836.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Software\Microsoft\Internet Explorer\International	5a9493ee7bb582d06c5bc71fc6759836.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	5a9493ee7bb582d06c5bc71fc6759836.exe
1600	5a9493ee7bb582d06c5bc71fc6759836.exe

C:\Users\Admin\AppData\Local\Temp\5a9493ee7bb582d06c5bc71fc6759836.exe
"C:\Users\Admin\AppData\Local\Temp\5a9493ee7bb582d06c5bc71fc6759836.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x00000000020B0000-0x00000000020D4000-memory.dmp

Filesize
144KB

Download
memory/1600-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1600-20615-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1600-40625-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1600-45965-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1600-62996-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1600-80772-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1600-80773-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download