16fae8bf902ffa3e2f411b4662a60531be5167c19e79ca310d7589c178a7e40e

Analysis

max time kernel
122s
max time network
163s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6b2ffc7b71143b85951f5dd318b243ad.exe
Size

908KB
MD5

6b2ffc7b71143b85951f5dd318b243ad
SHA1

b67514bfbda2e3ad9df487aa84997b025b663248
SHA256

16fae8bf902ffa3e2f411b4662a60531be5167c19e79ca310d7589c178a7e40e
SHA512

912dc6a1a4efc4b990c53c85f4098e656f9305cc7887fc4df55389ae78413691e3194e94766ebbcd163e9d9e12ce22edfc2dd8f19bd0589f33b7ed6f522f6a32
SSDEEP

24576:ZgkPnXqTXd/juSyG0uHWm91TE4tUtXz4mEOvfBCUlXFwY63W:ZVOd9yG0u2c12z7BCCVw1W

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6b2ffc7b71143b85951f5dd318b243ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	6b2ffc7b71143b85951f5dd318b243ad.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	6b2ffc7b71143b85951f5dd318b243ad.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	6b2ffc7b71143b85951f5dd318b243ad.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	6b2ffc7b71143b85951f5dd318b243ad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2540	6b2ffc7b71143b85951f5dd318b243ad.exe
2540	6b2ffc7b71143b85951f5dd318b243ad.exe

C:\Users\Admin\AppData\Local\Temp\6b2ffc7b71143b85951f5dd318b243ad.exe
"C:\Users\Admin\AppData\Local\Temp\6b2ffc7b71143b85951f5dd318b243ad.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads