77ee2b602b2a17e503291a95d753408c5602b684a0b49e659231fa9209f7ae73

Analysis

max time kernel
1s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d30335e2bbbb84e081c57b050232f3d.exe
Size

45KB
MD5

3d30335e2bbbb84e081c57b050232f3d
SHA1

e6ea0575dcac78d83c0a2effe5ef3f15a9c49494
SHA256

77ee2b602b2a17e503291a95d753408c5602b684a0b49e659231fa9209f7ae73
SHA512

f82de58c1ed3b4f4433bbe1806af4d06f5b0471e75382c981d5820bb1a75a0bf4a55002625e0346dd11a3ab37343035ab7ad981da2297c162d5c8adc5b0629ca
SSDEEP

768:TKzyUZUpjGZu2QZ6zJzZykPK+Iha50swd0aIY+sNDp6stYH:TIybpjG847KvHswN+st

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\iexplore.exe	3d30335e2bbbb84e081c57b050232f3d.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\iexplore.exe	3d30335e2bbbb84e081c57b050232f3d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RegText.reg	3d30335e2bbbb84e081c57b050232f3d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\Open(&O)\Command	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\Open(&O)\Command\ = "C:\\Program Files\\Internet Explorer\\SIGNUP\\iexplore.exe %1 h%t%t%p:%//%w%w%w.si%n%a%11%12%13.%n%e%t/?l"	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\ = "HideOnDesktopPerUser"	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\iexplore.exe"	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\ÊôÐÔ(&R)\Command	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\ = "HideFolderVerbs"	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\DefaultIcon	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\Open(&O)	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\Open(&O)\ = "Open(&O)"	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\ÊôÐÔ(&R)	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\ = "WantsParseDisplayName"	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ = "Internet Explorer"	3d30335e2bbbb84e081c57b050232f3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\Shell\ÊôÐÔ(&R)\Command\ = "rundll32.exe shell32.dll,Control_RunDLL inetcpl.cpl,,0"	3d30335e2bbbb84e081c57b050232f3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder\Attributes = "0"	3d30335e2bbbb84e081c57b050232f3d.exe

Runs .reg file with regedit 1 IoCs

pid	Process
1220	regedit.exe

C:\Users\Admin\AppData\Local\Temp\3d30335e2bbbb84e081c57b050232f3d.exe
"C:\Users\Admin\AppData\Local\Temp\3d30335e2bbbb84e081c57b050232f3d.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\3d30335e2bbbb84e081c57b050232f3d.exe"
  2⤵
  PID:1908
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /S C:\Windows\RegText.reg
  2⤵
  - Runs .reg file with regedit
  PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4460-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4460-1-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/4460-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4460-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download