2ebb03a90db6094ac68e675cfd1cbfb3e64b20736788b4d0091571affb108707

Analysis

max time kernel
91s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

majorbluesscales.exe
Size

1.6MB
MD5

89f5a86b645076bdbf61890f0158161b
SHA1

bfc71f839e1fd3372ed9c040ec28a76b04ace870
SHA256

755f3c6bb6c9acf3b2a53e99976a0cd1f7092c313c56a79a1b3c15e66315d60c
SHA512

ed5931feac32333298b73bcb9f65a2c0b27a97c665da3cf462b1a27864ccbc20e66fc3a3dfa224c9af349d913ea6000b8914b5b2c246bebba29c01878cc6feff
SSDEEP

24576:jRS53NODMN3II53p8HvaIgAmJtPlTfxTUFfCxZeR:jRS534DMms3maIgrtPlTfuFBR

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ANS2000.INI	majorbluesscales.exe
File opened for modification	C:\Windows\system.ini	majorbluesscales.exe
File opened for modification	C:\Windows\win.ini	majorbluesscales.exe
File created	C:\Windows\a3kebook.ini	majorbluesscales.exe
File opened for modification	C:\Windows\akebook.ini	majorbluesscales.exe
File created	C:\Windows\akebook.ini	majorbluesscales.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Software\Microsoft\Internet Explorer\IESettingSync	majorbluesscales.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	majorbluesscales.exe
Key created	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	majorbluesscales.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	majorbluesscales.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3044	majorbluesscales.exe
3044	majorbluesscales.exe
3044	majorbluesscales.exe
3044	majorbluesscales.exe

C:\Users\Admin\AppData\Local\Temp\majorbluesscales.exe
"C:\Users\Admin\AppData\Local\Temp\majorbluesscales.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e\87946-111026-011617-65.a2k\index.html

Filesize
3KB

MD5
a6cc4301c959fa080900e93f32a9add9

SHA1
2da5b7fcbb566a4b7726756641c60db5ec47493f

SHA256
87eb14dc156706298cffc711b98d8f00b818c1433bbeeb263d13b7d8dea34d3e

SHA512
0e60f81713aacb85758f1dc547f5c9a7e816908d6e3ae1a13910de2bec5cabd36f660535a626b20df9754d4a167c3780f9f1c898d82f1f5d4c12eac750e152e1

Download Submit
C:\Windows\system.ini

Filesize
276B

MD5
bcf4b00704dbc0bf97c8e9563fab6678

SHA1
2117f06b3d2900150d19570e06dc2fc26e022af6

SHA256
34b40809e27aca000c2834188a2705d1edf266befbd5c45f27c1bb0754d2f43f

SHA512
6ff2cebd4d280a2bfa604f94b42c447d0a0bd1c44c9237150edc707f5c23ee3738aa52e646572a950306e7583054017c207636cb9daea6e606c46025b8b44d28

Download Submit
C:\Windows\win.ini

Filesize
183B

MD5
3b7dc8dc2b56da931f5d072792c0b5ce

SHA1
c7ead06675d442aef7b241f71c4c9da9e41b783d

SHA256
4d7d04c67093980e07d5567e09b88d1fbcbf507900e271ad4586269b342bc671

SHA512
9109750645b6001ee19e76268c18fb2113a3f2f07ff29516c207dca3f0e01249a46641b87e5749a8227655d63328071f49a39467e6045dc5ba333a928be6612a

Download Submit