62e96c6b1889e39c161cb104e416f87355474ccba8d98a5acd19a816d01ca8fb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c0bb77ac96bbbf761cb3affb2f1013a.exe
Size

173KB
MD5

8c0bb77ac96bbbf761cb3affb2f1013a
SHA1

4a767fdc8577c93413feda78a478707824b9e0a3
SHA256

62e96c6b1889e39c161cb104e416f87355474ccba8d98a5acd19a816d01ca8fb
SHA512

5e03f326aa7dbcdf3cd419a6193dd75a0a51cb4a823799f76734b861997d21a4446cd581929bc4895373dbc76d6e4dbea1adeb0ba9fdaf8518667ac973e0adc9
SSDEEP

3072:j2LAYuJoPKV1mIsIwXtHWHVATMiFIpQXr6t5Mcai:pJoPbIsQ1ATqWrkjD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	8c0bb77ac96bbbf761cb3affb2f1013a.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	8c0bb77ac96bbbf761cb3affb2f1013a.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	8c0bb77ac96bbbf761cb3affb2f1013a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	8c0bb77ac96bbbf761cb3affb2f1013a.exe
2756	8c0bb77ac96bbbf761cb3affb2f1013a.exe

C:\Users\Admin\AppData\Local\Temp\8c0bb77ac96bbbf761cb3affb2f1013a.exe
"C:\Users\Admin\AppData\Local\Temp\8c0bb77ac96bbbf761cb3affb2f1013a.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\disclaim.html

Filesize
19KB

MD5
4407ba6a64eb8214288a301ccdb63021

SHA1
a72537c0095fb40938b6843ef8ce31c743a9978b

SHA256
c8e9940e1916bb8367e67857e9acefadc24640018cb45f2002281ba472143012

SHA512
c0b7488f22a89d1f5371f346d0b4b12dddef85998774923075b7d86eb2fc14173d341253464cba386ba98a9dba4c440d49ce3e520233e771fe42eb80c29d1348

Download Submit
C:\Users\Admin\AppData\Local\Temp\index.html

Filesize
18KB

MD5
31573b7eaee2afc8dd3a39b3430eda88

SHA1
259233030a353d8ef2912d4eb5765af041f5e267

SHA256
5b723e12d4c0beec5ec4924fb53a57a6c0059bdaf57b68f7cd6d6dd3aae654ee

SHA512
79ebe98ad3840fc43d25c5452ff381ea2f7acd7b39e12dcb290bef4e4a2080fedc50ae5a2a3a98f91febdd3bc2524a7556badd5a2357a61ec9900425732baf28

Download Submit