79decf032c1467047c31d4d876180a6e54112751fe25fc503cbd11eed6fa248e

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

657c76db82bd813d34b849253ced80ad.exe
Size

1.6MB
MD5

657c76db82bd813d34b849253ced80ad
SHA1

51bb0ea8bd01e7ba06b4284ab63d9cea4b4fee31
SHA256

79decf032c1467047c31d4d876180a6e54112751fe25fc503cbd11eed6fa248e
SHA512

d4e5af80f40db5e0318066c6eb248ca47af6191e98b5aee4d69be53fe0db7c6ff049f78f22dc7742eefe31ad3199c169e2b1847d3199ccd49232071ebe29f065
SSDEEP

49152:5Hf9VQRRqvelYDVPddMgGuL83/YfTqIrY:5lVSgdDJM3wW

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	657c76db82bd813d34b849253ced80ad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	657c76db82bd813d34b849253ced80ad.exe
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\IESettingSync	657c76db82bd813d34b849253ced80ad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	657c76db82bd813d34b849253ced80ad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1004	657c76db82bd813d34b849253ced80ad.exe
1004	657c76db82bd813d34b849253ced80ad.exe
1004	657c76db82bd813d34b849253ced80ad.exe
1004	657c76db82bd813d34b849253ced80ad.exe
3600	657c76db82bd813d34b849253ced80ad.exe
3600	657c76db82bd813d34b849253ced80ad.exe
3600	657c76db82bd813d34b849253ced80ad.exe
3600	657c76db82bd813d34b849253ced80ad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3600	657c76db82bd813d34b849253ced80ad.exe
3600	657c76db82bd813d34b849253ced80ad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3600	1004	657c76db82bd813d34b849253ced80ad.exe	89
PID 1004 wrote to memory of 3600	1004	657c76db82bd813d34b849253ced80ad.exe	89
PID 1004 wrote to memory of 3600	1004	657c76db82bd813d34b849253ced80ad.exe	89

C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe
"C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe
  "C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_10171e9d0"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pkg_10171e9d0\autorun.txt

Filesize
107B

MD5
eb7c181b277d2b4297b731527466956d

SHA1
7ee9ecaf0f4a1c9f06047048283ff767cad486bc

SHA256
d220c3065fb7f0162e725b54807c0f7e68103c2b759e4ef607c285527be21dc8

SHA512
cbd1c1e8a1c2d21b671a9f5e861d499ef75997e205c406d506cfab07f2b08522d37ef751e265690ab6a4c31c8808a70cea8b97d5c1cdacca07c6f2d3f232b32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_10171e9d0\wrapper.xml

Filesize
798B

MD5
1d45a29e3511b982a1f91b33c70e964f

SHA1
176a47b489be3f27dc354a2b9dd0b580bb2f3904

SHA256
0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

SHA512
c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

Download Submit