21752d701ba9884a7a56ace43ae613d368696e26462f77dbc702191c7161a519

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Zusy.508517.2343.exe
Size

265KB
MD5

c01db0ba6f79e2f07035956a584561b5
SHA1

9dad7350911575734a5a2018a558554f064b4ffa
SHA256

21752d701ba9884a7a56ace43ae613d368696e26462f77dbc702191c7161a519
SHA512

35aa5f78be35547a469077c3944f6e0119f985503d97191753b517e451e851c343632f364dc1d7a9853246293e9036ee479d08ee7da6e4c1015e2437af6451bc
SSDEEP

3072:yNzJHjt21qIe+qse114h+pmCakonbZjxuskJ:EzJZr+611iHus

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	SecuriteInfo.com.Variant.Zusy.508517.2343.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	SecuriteInfo.com.Variant.Zusy.508517.2343.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\IESettingSync	SecuriteInfo.com.Variant.Zusy.508517.2343.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	SecuriteInfo.com.Variant.Zusy.508517.2343.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
892	SecuriteInfo.com.Variant.Zusy.508517.2343.exe
892	SecuriteInfo.com.Variant.Zusy.508517.2343.exe
892	SecuriteInfo.com.Variant.Zusy.508517.2343.exe
892	SecuriteInfo.com.Variant.Zusy.508517.2343.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.508517.2343.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.508517.2343.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads