e687d860e646be82c8fdcfcd8b534ccd39cf435f492dfa0f4183366a53010ebe

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:37

Target

035569db2552cd12f6a66d028d1b7967.exe
Size

202KB
MD5

035569db2552cd12f6a66d028d1b7967
SHA1

d5797dd615a74a07c5dc7bf01ac9559a3d6321d1
SHA256

e687d860e646be82c8fdcfcd8b534ccd39cf435f492dfa0f4183366a53010ebe
SHA512

a994a1d68c3f883e23879e398e2a6937745383f0415c26689d94ddad0c43a0213a6508d35453516632138e1b03b9c0a9f29c16bee9eac41334ae5e0bc8f84988
SSDEEP

6144:FOew3SZpwQWwnogdmjMTXnL58ogrkKPi:MVdwnogIMXn+ogIWi

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	035569db2552cd12f6a66d028d1b7967.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\IESettingSync	035569db2552cd12f6a66d028d1b7967.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	035569db2552cd12f6a66d028d1b7967.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	035569db2552cd12f6a66d028d1b7967.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4592	035569db2552cd12f6a66d028d1b7967.exe
4592	035569db2552cd12f6a66d028d1b7967.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4592-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/4592-1-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/4592-2-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/4592-4-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/4592-9-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download