Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 05:21

General

  • Target

    ֮.exe

  • Size

    1.1MB

  • MD5

    331810e9f6de0679e9cd337aa026aab4

  • SHA1

    88cbc6a80afcfdd2d5506d8f73ca889a669c5eed

  • SHA256

    7c06daa6628997c39580b86e9601ee35c7e688efe0079d11517310f6433911cf

  • SHA512

    5c82f7a497519d8a466d898701c210c27908d12ec9ff0dae56e121b574551648fcbb30d2af0c8e2bdb9b3fc1f86801bdea0fe23858b721a61905eeabcb59e55d

  • SSDEEP

    24576:oWTeo4A7fKVV/NeK2TYIT4/oFaASoA6Vfnw:dTeq7SH/yTYIT4QIoA6Vfnw

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\֮.exe
    "C:\Users\Admin\AppData\Local\Temp\֮.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:1976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b99d1c1ae417621f09f3f042cc7a247b

    SHA1

    f96a626ed558836bf2e747aa5a794d352172330d

    SHA256

    aceb17092264596ceb724b5db2283479ebbf08c3cf5c8f7a77f3427d26f3a326

    SHA512

    470f3938fc5d56a7b4b3f11a4a02c505ac70341f37fdfc4021964fb94a6c4cad585e0f30b03ebd4a8ad718701a48a2406694afe16120fa1f7910c8de6591f3a4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7427b14bafec6d028e8678354a15a313

    SHA1

    e9f6b98061abda16ddaefc438036d9663e44a938

    SHA256

    049ea1a08282221347536ca211352d4a284ccc9b1df5864249a7583e7d98dbf8

    SHA512

    f3668a5c3a29f889726b8e17fb5f5de610e50f6a25e569d67ea2012bbb3835eb1175b6a821637602bf5545927c0412845e8a0b30656aca6129d4b2ca6756db18

  • C:\Users\Admin\AppData\Local\Temp\Tar1C3F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\twcache.ini

    Filesize

    134B

    MD5

    ad554b96d89f47b2cacc8a96694a6335

    SHA1

    89451393bcb908d8af851f7fbe845a31e3afa0a9

    SHA256

    494ff9fbb10590cb66a7c24d274ea78a78f8bd62f8e52fdd00f48811cac02407

    SHA512

    18f14e2dbe0470d01a1bbcb952ee6b52f651f7df32e2a56d3c40acf1f3936418d25116c9d59f669fdbc6904fc227a60d3eb02742164048b8e49944220a99c181

  • C:\Users\Admin\AppData\Local\Temp\twcache.ini

    Filesize

    158B

    MD5

    7f182b48b94463876f70b6b6b5a330b9

    SHA1

    ede3fe9709ba4005fa442e6a3d6d9dec18643af1

    SHA256

    3e2626495e6ab04333789fbbabfb56fb7a827667a743b8864e936762fb8baaf7

    SHA512

    73a9b43844878123e072952b4f163d8bbfba948dddc2a546bbd7365c1d5c954af2df45f75b2a549deb90c3045bedb6676c21f37d3189ebe7c4d1bbaf41001dba

  • C:\Users\Admin\AppData\Local\Temp\֮.ini

    Filesize

    7KB

    MD5

    a158daf52fb091120dc7b4824a75111a

    SHA1

    26c9a167ef8ca2169c6c09e674697361f86b83d9

    SHA256

    bca1de78892c4ecfc9b5bace2798e844b3e19005eae7c69ba6453a09d7788832

    SHA512

    9e45bbe7a56fa54d5e3c081b2d79a21f3059275d0e81c50c08e8a04de3f52b638063adf22a7a3afb469f94b65bf5312030b04b47d47d2c57ed612bccd4b4106d

  • memory/1976-0-0x0000000004A00000-0x0000000004A02000-memory.dmp

    Filesize

    8KB