2be83f88d439ec15887627b3bd6b517973aed5f12c414c7d2b74f50bd7afcdd5

Analysis

max time kernel
166s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4714b3900b2063076e62d1ea15b76f7.exe
Size

420KB
MD5

c4714b3900b2063076e62d1ea15b76f7
SHA1

683ac0227feca6fdde445f75161dcaa46314e1e5
SHA256

2be83f88d439ec15887627b3bd6b517973aed5f12c414c7d2b74f50bd7afcdd5
SHA512

f45320fa37aa6a425e83e68c42cf2e967a1b017b0178c238943a27e6d1d3a761d7597deb6266335de48d55bcba251ed366bb29438232dad4c4f177ef9603ba32
SSDEEP

6144:3YTTJl0BlFnA95P7w33TnYYTHy9XiUCH4J8CraJH/V7CtYfXn8WPXc7aHvl:32TJlKRykTYYwm4J9rmZCtYPRPMud

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	c4714b3900b2063076e62d1ea15b76f7.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\IESettingSync	c4714b3900b2063076e62d1ea15b76f7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	c4714b3900b2063076e62d1ea15b76f7.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	c4714b3900b2063076e62d1ea15b76f7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4760	c4714b3900b2063076e62d1ea15b76f7.exe
4760	c4714b3900b2063076e62d1ea15b76f7.exe

C:\Users\Admin\AppData\Local\Temp\c4714b3900b2063076e62d1ea15b76f7.exe
"C:\Users\Admin\AppData\Local\Temp\c4714b3900b2063076e62d1ea15b76f7.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:8
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\td0\Documents and Settings\Marcelo Oliveira\Desktop\Server Launcher.htm

Filesize
2KB

MD5
8289386286feddc1fefb2f9921583b60

SHA1
8299407e3e4a6bc747cbac270b983083c84a673b

SHA256
6b5e8d4d4b0631dbbfbb1b00624694c4d32b8703cdea301eb7d8315f73259351

SHA512
e08162ce7b0d70d9487d55df638f7801c46d677a0bf3a507e5744b3e3c47100e7eb376cccd499a813eb10b671e089fa519eb3d3af9915d9fa1c26158118b0d0a

Download Submit
memory/4760-0-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/4760-11-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4760-13-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download