02b80ac9f3b18c4e888dee48fb093be72a40cb35a448807eae069332cf3faaf8

Analysis

max time kernel
0s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0872e648e3dcd864e4afa2cc77de5afd.exe
Size

168KB
MD5

0872e648e3dcd864e4afa2cc77de5afd
SHA1

5426feef141fc241f200ccfcc8eb18bd0f2b4540
SHA256

02b80ac9f3b18c4e888dee48fb093be72a40cb35a448807eae069332cf3faaf8
SHA512

9a1c72bde6e23f3f6b4dbf60e841f781f671074da9c68fe10385d71437809b968bedb9167c940ac1c2f136c0a7186440e16d54b102a629c2c76aeb0829b2bf8b
SSDEEP

3072:N0ljdmx27ZnsUbic6NPiuVyFpxsX4M0/lkbrrQXoYQsnsqoTiFf3D4yUWwhaRSGv:NMjC2N3iTNquVy3U4MMlgdTiFf3/jwk1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2264	1664	0872e648e3dcd864e4afa2cc77de5afd.exe	16
PID 1664 wrote to memory of 2264	1664	0872e648e3dcd864e4afa2cc77de5afd.exe	16
PID 1664 wrote to memory of 2264	1664	0872e648e3dcd864e4afa2cc77de5afd.exe	16
PID 1664 wrote to memory of 2264	1664	0872e648e3dcd864e4afa2cc77de5afd.exe	16

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://video.globo.com/Videos/Player/Noticias/0,,GIM855278-7823-TENTATIVA+DE+SUBORNO+QUE+COMPROMETE+DANIEL+DANTAS+E+REVELADA,00.html
1⤵
- Modifies Internet Explorer settings
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  PID:2744

C:\Users\Admin\AppData\Local\Temp\0872e648e3dcd864e4afa2cc77de5afd.exe
"C:\Users\Admin\AppData\Local\Temp\0872e648e3dcd864e4afa2cc77de5afd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37a059c52cf6dca4b57f6c61ccaacdc0

SHA1
62384ff279a2aff0f0e76342f3ccce7be88b221a

SHA256
b4e9c54b4b159e1b600b772e9dd4d84c8239729d9d13c87350a3740b4c2e75c0

SHA512
abe53ccfcc1e8677debe03d6dc058ffa9e60c11ea4b304aa0a95d31a750977b6e8bf202327f340702dda4661dbff07880caed368154d2ed2a5bed292367593b6

Download Submit
memory/1664-2-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1664-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1664-1-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1664-0-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1664-113-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1664-197-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1664-631-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1664-1067-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1664-1071-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download