a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-06-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
Size

4.8MB
MD5

39490d6ae5b10a8cdffecd71d05141dd
SHA1

450da6260c6817aca8d9444831a48439ba45785c
SHA256

a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb
SHA512

7ffb9cb6a53cf233b6ff396eeb6193e683aed75001b3f73a1bbadaeec3ff7dcbce9b7e215d1743a4374e488185b824b90dde4afe93a8d93608b6340af07c14fb
SSDEEP

98304:rcAf/HlqfEBwysMKalG8zzgg+t2TIJIX3gGKV0wMa8/FJjVBl5+pEs:rr/lqfEBwlMllPzzp+t2540w0jjVP5A

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\IESettingSync	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe

pid	process
1152	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
1152	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
1152	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
1152	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe

pid	process
1152	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
1152	a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe

C:\Users\Admin\AppData\Local\Temp\a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe
"C:\Users\Admin\AppData\Local\Temp\a9427d47bf1cfadd009990ca09feb2af88823f5908b17e2afa70c8c49c95b3eb.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
1⤵
PID:992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\Montserrat-Regular.eot
Filesize
314KB

MD5
2dd0a1de870af34d48d43b7cad82b8d9

SHA1
440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e

SHA256
057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32

SHA512
83df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\pixelsee-installer-tmp\preloader.html
Filesize
826B

MD5
37a05031bec9d3e093388407848af66f

SHA1
5b48a5b72097ad98eacf54e956e94d26710a0493

SHA256
cf38f4f8663028beff3a7650a9d426b4116891e8547029b66b8d2a13fad63a48

SHA512
db3af55b93e901778a74f462af1f80a3e4181b251b061f858a3a6dadc77f2eaf4760c30f4ef9ae5560418eadb6133d474289c3b84c0e89615670af722d8dab9f

Download Submit