851611b6ae78329a976f6b4e075de7faf52c25d1041089759f32fd9eb7e30d2b

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:50

Target

7522a6d499d6f0f2cd2aa1c18dc66d00.exe
Size

422KB
MD5

7522a6d499d6f0f2cd2aa1c18dc66d00
SHA1

bb738e5f1bdab3188de0ff157632afcbdf26e91a
SHA256

851611b6ae78329a976f6b4e075de7faf52c25d1041089759f32fd9eb7e30d2b
SHA512

1e642c7871dbaa0029c69736e74b5b677af25b1e2e4ed023b21b9d60a07a9fa7335f6d0ab39709d508e3b05ce537e2f8af00931d96f901a75441dae070abe574
SSDEEP

6144:PRoOE29N2YNfHPySiF0rVSpk/R55YvtmtaIVWF1ZXa+pDqLj3BZjCom7BIZpCVeI:ZoOPSYBkf0aIVWF1x9pD4s7ApCw1Ua

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

Modify Registry

Processes:

7522a6d499d6f0f2cd2aa1c18dc66d00.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	7522a6d499d6f0f2cd2aa1c18dc66d00.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	7522a6d499d6f0f2cd2aa1c18dc66d00.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	7522a6d499d6f0f2cd2aa1c18dc66d00.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

7522a6d499d6f0f2cd2aa1c18dc66d00.exe

pid process

2268 7522a6d499d6f0f2cd2aa1c18dc66d00.exe
2268 7522a6d499d6f0f2cd2aa1c18dc66d00.exe

pid	process
2268	7522a6d499d6f0f2cd2aa1c18dc66d00.exe
2268	7522a6d499d6f0f2cd2aa1c18dc66d00.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2268-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2268-20-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download