065aaf020f98e04ad09ba01d1bcce53f6031993eef38f3d26bb91e40c49e4186

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3efca2d2702a4ba164bb53a11e42cc99.exe
Size

967KB
MD5

3efca2d2702a4ba164bb53a11e42cc99
SHA1

1ce4d5961b4047cd83808a08d59175e314df9d7e
SHA256

065aaf020f98e04ad09ba01d1bcce53f6031993eef38f3d26bb91e40c49e4186
SHA512

29dc966fd28f02237b0097bd998a7cc19d8f08e890066c4d409b118836c183777a2d784e9fdabad0add83ad6f199e38b962e13a3386f18cc74c961b710f3dff7
SSDEEP

24576:OqzKd9mUPBCSmSrRRxFMXwf0YYWJ6dh177eg4Ntf:OqzK9Zjh/LMAVYdhZvEt

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1520-0-0x0000000000400000-0x000000000071D000-memory.dmp	upx
behavioral1/memory/1520-6-0x0000000000400000-0x000000000071D000-memory.dmp	upx
behavioral1/memory/1520-7-0x0000000000400000-0x000000000071D000-memory.dmp	upx
behavioral1/memory/1520-8-0x0000000000400000-0x000000000071D000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	3efca2d2702a4ba164bb53a11e42cc99.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1520	3efca2d2702a4ba164bb53a11e42cc99.exe
1520	3efca2d2702a4ba164bb53a11e42cc99.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1520	3efca2d2702a4ba164bb53a11e42cc99.exe
1520	3efca2d2702a4ba164bb53a11e42cc99.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1520	3efca2d2702a4ba164bb53a11e42cc99.exe
1520	3efca2d2702a4ba164bb53a11e42cc99.exe

C:\Users\Admin\AppData\Local\Temp\3efca2d2702a4ba164bb53a11e42cc99.exe
"C:\Users\Admin\AppData\Local\Temp\3efca2d2702a4ba164bb53a11e42cc99.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1520-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1520-0-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/1520-6-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/1520-7-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/1520-8-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download