e9d828a5052ca78bfd1a41acb8ca5ee44d52f30d0333554fa071d441944d1093

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aab95e4f3394f9e4ef032f72d55773ab.exe
Size

228KB
MD5

aab95e4f3394f9e4ef032f72d55773ab
SHA1

d991139fca3876dfa9e716922c2d067545b77ff4
SHA256

e9d828a5052ca78bfd1a41acb8ca5ee44d52f30d0333554fa071d441944d1093
SHA512

c87b71219bc1d2d44a28bbc287ab3124b76cff392236935302f06452bb68419bc54d01f65396d2f76d6f4fd74d886f12da7f7fb52cff8169547bb362c55ec87d
SSDEEP

6144:MRT9A65pP1wlYgrN1y6V1X1RonMequ8+my5ET7zW:MA65XwlYgrHy6V17kr8+m73zW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2940-0-0x0000000000400000-0x0000000000497000-memory.dmp	upx
behavioral1/memory/2940-7-0x0000000000400000-0x0000000000497000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2940-7-0x0000000000400000-0x0000000000497000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\main	aab95e4f3394f9e4ef032f72d55773ab.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.1283.net/?1104zzzj"	aab95e4f3394f9e4ef032f72d55773ab.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	aab95e4f3394f9e4ef032f72d55773ab.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	aab95e4f3394f9e4ef032f72d55773ab.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	aab95e4f3394f9e4ef032f72d55773ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.1283.net/?1104zzzj"	aab95e4f3394f9e4ef032f72d55773ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\" http://www.1283.net/?1104zzzj"	aab95e4f3394f9e4ef032f72d55773ab.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	aab95e4f3394f9e4ef032f72d55773ab.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node	aab95e4f3394f9e4ef032f72d55773ab.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Wow6432Node\CLSID	aab95e4f3394f9e4ef032f72d55773ab.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2940	aab95e4f3394f9e4ef032f72d55773ab.exe
2940	aab95e4f3394f9e4ef032f72d55773ab.exe
2940	aab95e4f3394f9e4ef032f72d55773ab.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2940	aab95e4f3394f9e4ef032f72d55773ab.exe
2940	aab95e4f3394f9e4ef032f72d55773ab.exe
2940	aab95e4f3394f9e4ef032f72d55773ab.exe

C:\Users\Admin\AppData\Local\Temp\aab95e4f3394f9e4ef032f72d55773ab.exe
"C:\Users\Admin\AppData\Local\Temp\aab95e4f3394f9e4ef032f72d55773ab.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/2940-7-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads