4179ef5a560e945506220ecc88f1b1b405bfef96a307694a6cad328a8760bdd8

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55f14b2201af3d9b928eeedf200e321b.exe
Size

537KB
MD5

55f14b2201af3d9b928eeedf200e321b
SHA1

bedecf7e7ad0a089aeea3d8a7d33ecce8da0f54e
SHA256

4179ef5a560e945506220ecc88f1b1b405bfef96a307694a6cad328a8760bdd8
SHA512

38d72123feb173bf0d7d082172c8674808b6ab38d00074dd88ee4ea1cba31cd4219e220c3b4ce0066eaeff0294185449a8c8077d3e4c84b96113a393fbacd008
SSDEEP

12288:LoIRwgxVeseoy5+wHbUUXdrrn9HQo30veSBiQPp4kv8jZ:kIRwgxVheRRbUjRGELPpFUl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2836	EntMian.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	EntMian.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\EntMian.exe	55f14b2201af3d9b928eeedf200e321b.exe
File opened for modification	C:\Windows\EntMian.exe	55f14b2201af3d9b928eeedf200e321b.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01D5EC5F-C0E3-4DE1-A68E-082E5D8FBFE1}\7e-1e-6a-70-b3-4c	EntMian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1e-6a-70-b3-4c\WpadDecision = "0"	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1e-6a-70-b3-4c\WpadDecisionTime = c08744962f45da01	EntMian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	EntMian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	EntMian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	EntMian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	EntMian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01D5EC5F-C0E3-4DE1-A68E-082E5D8FBFE1}\WpadDecisionReason = "1"	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	EntMian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01D5EC5F-C0E3-4DE1-A68E-082E5D8FBFE1}\WpadDecision = "0"	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f002b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01D5EC5F-C0E3-4DE1-A68E-082E5D8FBFE1}\WpadDecisionTime = e03ec3c72f45da01	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1e-6a-70-b3-4c\WpadDecisionTime = e03ec3c72f45da01	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	EntMian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01D5EC5F-C0E3-4DE1-A68E-082E5D8FBFE1}\WpadNetworkName = "Network 3"	EntMian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1e-6a-70-b3-4c\WpadDecisionReason = "1"	EntMian.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	EntMian.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1e-6a-70-b3-4c\WpadDetectedUrl	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\7e-1e-6a-70-b3-4c	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	EntMian.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01D5EC5F-C0E3-4DE1-A68E-082E5D8FBFE1}	EntMian.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{01D5EC5F-C0E3-4DE1-A68E-082E5D8FBFE1}\WpadDecisionTime = c08744962f45da01	EntMian.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	55f14b2201af3d9b928eeedf200e321b.exe
Token: SeDebugPrivilege	2836	EntMian.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	EntMian.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2720	2836	EntMian.exe	29
PID 2836 wrote to memory of 2720	2836	EntMian.exe	29
PID 2836 wrote to memory of 2720	2836	EntMian.exe	29
PID 2836 wrote to memory of 2720	2836	EntMian.exe	29

C:\Users\Admin\AppData\Local\Temp\55f14b2201af3d9b928eeedf200e321b.exe
"C:\Users\Admin\AppData\Local\Temp\55f14b2201af3d9b928eeedf200e321b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\EntMian.exe
C:\Windows\EntMian.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\EntMian.exe

Filesize
537KB

MD5
55f14b2201af3d9b928eeedf200e321b

SHA1
bedecf7e7ad0a089aeea3d8a7d33ecce8da0f54e

SHA256
4179ef5a560e945506220ecc88f1b1b405bfef96a307694a6cad328a8760bdd8

SHA512
38d72123feb173bf0d7d082172c8674808b6ab38d00074dd88ee4ea1cba31cd4219e220c3b4ce0066eaeff0294185449a8c8077d3e4c84b96113a393fbacd008

Download Submit
C:\Windows\EntMian.exe

Filesize
31KB

MD5
7207b17c316d7a7ec5afc93aee482c83

SHA1
84eef8bca994669f0fb93c2d114914b891f1f244

SHA256
52d569d41734b14a5273496ef36a38da76638876745dcfaa0211eb8a10e5fd5b

SHA512
d15478a54898e89ebb9af78d17b6d21ed4cf39df3609ee1055da509343a942b5037eed7af93f5e814b0fdd2011802b4b3c2b5ac97f4acd8697abec3c11add861

Download Submit
memory/2080-7-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/2080-0-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/2080-8-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2080-16-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/2080-4-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/2080-3-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x0000000000330000-0x000000000037B000-memory.dmp

Filesize
300KB

Download
memory/2080-2-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2080-6-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2080-19-0x0000000000330000-0x000000000037B000-memory.dmp

Filesize
300KB

Download
memory/2080-5-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2080-9-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2836-17-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2836-13-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/2836-14-0x0000000000270000-0x00000000002BB000-memory.dmp

Filesize
300KB

Download
memory/2836-15-0x0000000000270000-0x00000000002BB000-memory.dmp

Filesize
300KB

Download
memory/2836-20-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download
memory/2836-22-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2836-25-0x0000000000400000-0x0000000000505200-memory.dmp

Filesize
1.0MB

Download