41df4f4654867fc59b69cd3231909f69ce56da634adfb49926dfabc57aa32ca6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

180e4fe76eabad90635be8cbd39b4b9c.exe
Size

479KB
MD5

180e4fe76eabad90635be8cbd39b4b9c
SHA1

11993c3ca33eba0e87254a9b9a73c4f963d2f147
SHA256

41df4f4654867fc59b69cd3231909f69ce56da634adfb49926dfabc57aa32ca6
SHA512

ddb5dc9ed6aabbd4023a764be50144cf9b6ca1de3b720e5717daf7a50c2bdf1ad148e1b7dae2375fc9c579ed6c01babcaaa81fbba58534552d8aad498b48664b
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2928	180e4fe76eabad90635be8cbd39b4b9c.exe
2928	180e4fe76eabad90635be8cbd39b4b9c.exe
2928	180e4fe76eabad90635be8cbd39b4b9c.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	180e4fe76eabad90635be8cbd39b4b9c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	180e4fe76eabad90635be8cbd39b4b9c.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	180e4fe76eabad90635be8cbd39b4b9c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	180e4fe76eabad90635be8cbd39b4b9c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2928	180e4fe76eabad90635be8cbd39b4b9c.exe
2928	180e4fe76eabad90635be8cbd39b4b9c.exe

C:\Users\Admin\AppData\Local\Temp\180e4fe76eabad90635be8cbd39b4b9c.exe
"C:\Users\Admin\AppData\Local\Temp\180e4fe76eabad90635be8cbd39b4b9c.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_12D5.tmp\utilities.xml

Filesize
159KB

MD5
01b9f54d1ea0c9effb02d069fab5ffe7

SHA1
416b077b44c0834303003b5ae2b33b9e36d2e5a0

SHA256
6b1b97697dcab08312e9ae4621fd15d3de617b4edea512d0c53ea6c097293372

SHA512
564d8bbf12815a645b798ede97b61d8d86a57ab6dfc3bf97e7abf847008cd18c093b37694a48c49531e9d3848771d435fe4c67f5745e02ebdda78d7beb74736e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ImInstaller\IncrediMail\status.xml

Filesize
243B

MD5
c74cc101f96818463168d4c98437507e

SHA1
394129eeed767b675d5db8b588857916571f2169

SHA256
3600f0a96ddc4c3f2515e5bda69eed1e6b6ca643c28cbc15dee3b96ea10ac1fc

SHA512
a12fb7b28a1b8cd9ada2e5a27952f0887e4996d5b10d6cd977a646d9348eea03dc67fb83d00f219f2c256de5c7e2de1e7029d106b363a6299cc558bf73e462ec

Download Submit
\Users\Admin\AppData\Local\Temp\IM_12D5.tmp\ActionEngine.dll

Filesize
1009KB

MD5
9f33f5afe6693f5ef2bab1ff9b68ca52

SHA1
01b12b2c2b389d2337548b6d41a11be4516d8039

SHA256
7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced

SHA512
221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad

Download Submit
\Users\Admin\AppData\Local\Temp\IM_12D5.tmp\ActionEngine.dll

Filesize
92KB

MD5
d5bf464233734dfa7f63993efa232f84

SHA1
7413b7d8bb73bc6f127319c81c93d01fe31a7ed2

SHA256
c1558470b5929a3ca418c53ffe9e6a179bbf244c1e3014ec8f436528bc318a49

SHA512
4cdcad5d008db4da53895f560003a47a4497474a03e335ec30b49a8ef53559cc5640623e65f7fe6ae11acc70b699c34bf37129dcfc0d0175b54059c6ea8e0387

Download Submit
memory/2928-106-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download