52e3f15e2f25ec07273fb7184dab8c2e343d7870b811e6a2950c4204acba4555

Analysis

max time kernel
146s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45f8ebccb7e76c493d0cde495029a32b.exe
Size

479KB
MD5

45f8ebccb7e76c493d0cde495029a32b
SHA1

3857879604b9812ec795c464f1c27f908bae4453
SHA256

52e3f15e2f25ec07273fb7184dab8c2e343d7870b811e6a2950c4204acba4555
SHA512

0b4b17b8585276e8560640bd78f541a8f1a1b7b3daf511155ff39697a192f56b95c61495d88b4dc925dbd32cd87672a98b392067d8a69bbd31b518aad1f68a92
SSDEEP

12288:nHO++IUBvCkfmvz756FGtkeSUknzp7tRuvftbObG:HxzUV5a75G0OtXggbG

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1256	45f8ebccb7e76c493d0cde495029a32b.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	45f8ebccb7e76c493d0cde495029a32b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1256	45f8ebccb7e76c493d0cde495029a32b.exe
1256	45f8ebccb7e76c493d0cde495029a32b.exe

C:\Users\Admin\AppData\Local\Temp\45f8ebccb7e76c493d0cde495029a32b.exe
"C:\Users\Admin\AppData\Local\Temp\45f8ebccb7e76c493d0cde495029a32b.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IM_5F46.tmp\ActionEngine.dll

Filesize
92KB

MD5
d5bf464233734dfa7f63993efa232f84

SHA1
7413b7d8bb73bc6f127319c81c93d01fe31a7ed2

SHA256
c1558470b5929a3ca418c53ffe9e6a179bbf244c1e3014ec8f436528bc318a49

SHA512
4cdcad5d008db4da53895f560003a47a4497474a03e335ec30b49a8ef53559cc5640623e65f7fe6ae11acc70b699c34bf37129dcfc0d0175b54059c6ea8e0387

Download Submit
C:\Users\Admin\AppData\Local\Temp\IM_5F46.tmp\instlangs.xml

Filesize
17KB

MD5
aa91818150cfadb667ae6f914d43dca0

SHA1
4411bd0038ccd464ed7597f0540cfe04867b9042

SHA256
2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5

SHA512
dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd

Download Submit
memory/1256-104-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/1256-151-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download