Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14-07-2024 23:09
General
-
Target
114IE.exe
-
Size
3.1MB
-
MD5
6da132acb38a83304f35543dc670e184
-
SHA1
688936ff1b95cefaa04c36e6a662719a59965b09
-
SHA256
ff1dae85ff708d8a51b99b0400c07fa068df6d953b597a422021019496224f69
-
SHA512
3dbbe03007054fd7d2a6153f775d1f4a092376ded43693a77100596939ad8595833c66834208188237a961d031e39a6f41ecd1aaa61243bdadb2cb57e9425f54
-
SSDEEP
49152:LubHDDMxSIVdydRr9/UWcTNb4Ywgl5vDk38zAU7Ebwnwp/6hYTe:Lu7YM/h9cTNbVwfMeKC6h
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\114IE.exe"C:\Users\Admin\AppData\Local\Temp\114IE.exe"1⤵
- Modifies firewall policy service
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bin\114Web.exeTango3 655400|23562⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c 0x4ec1⤵
- Suspicious use of AdjustPrivilegeToken