Malware Analysis Report

2025-08-05 17:00

Sample ID 240108-d8wgysbed6
Target 4a57c2f3c54980c48ec1d3f6f3fef9ad
SHA256 2f4297c8de03ad80b7c517339d34c34bb5d597b5c01e525b54faa50607733536
Tags
score
3/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
3/10

SHA256

2f4297c8de03ad80b7c517339d34c34bb5d597b5c01e525b54faa50607733536

Threat Level: Likely benign

The file 4a57c2f3c54980c48ec1d3f6f3fef9ad was found to be: Likely benign.

Malicious Activity Summary


Unsigned PE

Enumerates physical storage devices

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-08 03:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-08 03:41

Reported

2024-01-08 03:44

Platform

win7-20231215-en

Max time kernel

141s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe"

Signatures

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe

"C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe"

Network

N/A

Files

memory/2964-0-0x0000000000160000-0x0000000000161000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\td0\Users\USER\Desktop\document software\kingsize\index.html

MD5 df2cc487c575a0e3ce5d0c97c52cc50b
SHA1 691c88c30011f450a2f60ecba745232ff0276068
SHA256 08c5bc2e9748748655aaa34bcbd4ba005700ab28e7037551e47db3b9c18cfc18
SHA512 fa40385501609da5e38f79715604766bf42359e80b564d24d9debfbfa79ada351e4c4b63db9f8d87896717e8c432a19bed999ccb882626e005baa5512d090ac2

memory/2964-33-0x0000000000400000-0x000000000046E000-memory.dmp

memory/2964-35-0x0000000000160000-0x0000000000161000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-08 03:41

Reported

2024-01-08 03:43

Platform

win10v2004-20231222-en

Max time kernel

0s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe

"C:\Users\Admin\AppData\Local\Temp\4a57c2f3c54980c48ec1d3f6f3fef9ad.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
GB 87.248.204.0:80 tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 92.123.241.104:80 tcp
US 92.123.241.104:80 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
GB 87.248.204.0:80 tcp

Files

memory/1148-0-0x00000000005C0000-0x00000000005C1000-memory.dmp

memory/1148-11-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1148-13-0x00000000005C0000-0x00000000005C1000-memory.dmp