c35657ba3cfa9449c008c489aede45ada2cfe300466d04857fe300683b31851c

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1006c17602e1192d85f9b7f3379a90f9.exe
Size

224KB
MD5

1006c17602e1192d85f9b7f3379a90f9
SHA1

a1ceea85cde021e0005c1079ddebf45a1c004b83
SHA256

c35657ba3cfa9449c008c489aede45ada2cfe300466d04857fe300683b31851c
SHA512

77221648b09541c33c0b98b6e41e46d93ffc533ccb8c31932d7dc97eec700c7c2ae7515a39eb2981ce8ef7f7aa60a49c3776ce0223607a5ef051b2ef9b9c12e4
SSDEEP

6144:2PSc8Mjl6yECUxoITxmndtbsvYFYcJd193acooOAK9yH8h:2PSc8cl3EC7MxmndtsgYW9Ayc

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	1006c17602e1192d85f9b7f3379a90f9.exe
File opened for modification	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	1006c17602e1192d85f9b7f3379a90f9.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main	1006c17602e1192d85f9b7f3379a90f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\International	1006c17602e1192d85f9b7f3379a90f9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4848	1006c17602e1192d85f9b7f3379a90f9.exe
4848	1006c17602e1192d85f9b7f3379a90f9.exe

C:\Users\Admin\AppData\Local\Temp\1006c17602e1192d85f9b7f3379a90f9.exe
"C:\Users\Admin\AppData\Local\Temp\1006c17602e1192d85f9b7f3379a90f9.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4848-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-0-0x0000000000A40000-0x0000000000A5A000-memory.dmp

Filesize
104KB

Download
memory/4848-18483-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-43286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-49409-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-69963-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4848-79884-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download