694da3d4e2ee52ac854f07af415a124c684a0a302735f5f03aa4f5cff05b628a

Analysis

max time kernel
27s
max time network
15s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
11/01/2024, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GH Injector SWHEX - x64.exe
Size

26KB
MD5

7ffee764b0cd370cc15f587c2cdcc559
SHA1

b31c65b358bd749e06599a063cb4c1f4021f85fc
SHA256

694da3d4e2ee52ac854f07af415a124c684a0a302735f5f03aa4f5cff05b628a
SHA512

3a49ad7130710414a0cd2453ed08c1aafe9cd75c74bd2b5b3f73e48760026647675db6bb9359dc2a5262f31936a39f1a69d7826d28b5d37b3975cc7d3e0209eb
SSDEEP

384:v6BTt7YVmUD5Z+RngbbmkA+QLYpR+FxupGbwlEhwEEmQca3Uz/nc:cYYUDuRngbbmYG8i4g5Ejh3K/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1155165157-2721788668-771323609-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\GH Injector SWHEX - x64.exe
"C:\Users\Admin\AppData\Local\Temp\GH Injector SWHEX - x64.exe"
1⤵
PID:4992

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\UnprotectPop.gif
1⤵
- Modifies Internet Explorer settings
PID:4092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...