Analysis
-
max time kernel
93s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 10:28
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe
Resource
win10v2004-20240412-en
General
-
Target
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe
-
Size
1.1MB
-
MD5
af1e56057951887a763d4e97670a1036
-
SHA1
bc0b8c98c0fdbb805b8e8415a860be0966de30be
-
SHA256
5eb65feae4e36b791ced20aa9fb912311ab3f920613857819a51df2ccba9a485
-
SHA512
4a778b1c6ee14ad3f790ab00b421b351d06f05b688a6c80525133a158363602f417a10adfeb09724a2f20e39736df628bbcffe03f44e145550a1cd48d7900269
-
SSDEEP
24576:/ZepAVvX2Z3XFt81lUu28MMxO17zJZVtL0n31QIChuUO/vDBTo:BeyWf9HHhVOnl
Malware Config
Signatures
-
Drops desktop.ini file(s) 1 IoCs
Processes:
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exedescription ioc process File opened for modification \??\PhysicalDrive0 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe -
Processes:
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe = "11000" SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exepid process 2196 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe 2196 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exepid process 2196 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe 2196 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe 2196 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe 2196 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe 2196 SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe"1⤵
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\desktop.iniFilesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
memory/2196-0-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/2196-31-0x0000000000400000-0x0000000000518000-memory.dmpFilesize
1.1MB