db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026

Analysis

max time kernel
140s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
Size

1.4MB
MD5

6cd0739e0631add874c8b2bb1e86e52b
SHA1

aa5a022d828d4d412211f59413ca6c4c729aa193
SHA256

db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026
SHA512

f001bb0a89e365927504d13308f8c0b4fbe722e1eefc837ea0c0ffdbc5f7ee89649bf51aa71562f39c009c0ea61fa217dd27ca1b9575a570d58c66c21943b1aa
SSDEEP

24576:6tteK1ftbP1sQTQ7NkYTOXg6ri8Crbkcfo9X5yvisXlf2HuYaLvGvTBs96MtxjCr:6eK1ftbPCQTUNkKqPLlcvxXleHJaLvGD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1196-0-0x0000000000400000-0x0000000000683000-memory.dmp	upx
behavioral2/memory/1196-1-0x0000000000400000-0x0000000000683000-memory.dmp	upx
behavioral2/memory/1196-14-0x0000000000400000-0x0000000000683000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\IESettingSync	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1196	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
1196	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1196	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
1196	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
1196	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
1196	db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe

C:\Users\Admin\AppData\Local\Temp\db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe
"C:\Users\Admin\AppData\Local\Temp\db421f9afff8da225deefe6a13460d29cd545dc72ca21f7ec40229fc33a0a026.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/1196-1-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/1196-14-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download