edfc9ead7e6081c73f381bd64e6bcf5e66d6e618dd67a32321e927d7d999232f

Analysis

max time kernel
151s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac78580d39b4fbc5ef800cab5e2e4423.exe
Size

359KB
MD5

ac78580d39b4fbc5ef800cab5e2e4423
SHA1

185d4fc133587cb9e03e077dd69a8b9c2258a5f2
SHA256

edfc9ead7e6081c73f381bd64e6bcf5e66d6e618dd67a32321e927d7d999232f
SHA512

5e5fe68f950c7de93edeb18ba7602b72810b9c2c18a9b93f51c9f54743f5ae4155ad3301df311d0c5ccc969614f538d84c9e11aefb99bd9d6caca60f6f1ba034
SSDEEP

6144:ZgRyiIWQFpUv4/B+FrM144XlzKlUAzYYbuewX79GtPuB8PxwPh79i5s/CoS9iP6Q:3iMCv45+uK4VKXknewr9GBY85wPTi5sP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-31-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-36-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-37-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-46-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-47-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-49-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-50-0x0000000000400000-0x000000000050D000-memory.dmp	upx
behavioral1/memory/2200-56-0x0000000000400000-0x000000000050D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	ac78580d39b4fbc5ef800cab5e2e4423.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ac78580d39b4fbc5ef800cab5e2e4423.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ac78580d39b4fbc5ef800cab5e2e4423.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe
2200	ac78580d39b4fbc5ef800cab5e2e4423.exe

C:\Users\Admin\AppData\Local\Temp\ac78580d39b4fbc5ef800cab5e2e4423.exe
"C:\Users\Admin\AppData\Local\Temp\ac78580d39b4fbc5ef800cab5e2e4423.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\ac78580d39b4fbc5ef800cab5e2e4423.data

Filesize
797B

MD5
421d0499b8485849559dbc6ce82de7e8

SHA1
cd88f3648c864779ca7e8d1c21cabb1b53ad4fe4

SHA256
360f52202409f934a77c417e52660003943c59c5d7ff5a6c5a5097868a27f2ae

SHA512
13adda94c9a18601f140761669886888a5247a245a4c2ef730447c4cd7a7153978264e00fdeb4b85b688dc6a3a0b453a9816ec3a0c349c93aef40f78161c655b

Download Submit
C:\Users\Admin\AppData\Roaming\GetRightToGo\ac78580d39b4fbc5ef800cab5e2e4423.htm

Filesize
635B

MD5
33f09577707d079a40f706a18e126d92

SHA1
0cef1f55b72a84e584a51e79a6787ea78d74a603

SHA256
e7f6bd122fcb829793f4047a5b929668b0a91ebfe31247b479586ec6d8f2b378

SHA512
5538c5b4e538a97796bfc412b3a81449931a9bbc1fa4e69500a0b30b35c1259bda857f392d85d87893999098bc88a432f28d2f699fadc295709a75b8113933cb

Download Submit
memory/2200-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-31-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-36-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-37-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-46-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-47-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-49-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-50-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2200-56-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download