61355ed01fe60ff0b6af084d4721dbbcb973346832e1fdf3020050de4cbecdaa

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GarminMobileXT_5_00_60_S60_TW.exe
Size

17.1MB
MD5

6f057a94856781ed9301b5d8c9b0107a
SHA1

162fd96ecfb40e41bf253fb45e0d1a783d283524
SHA256

0d338952ab0455349fd45e7d580a3f8d895ffb7c7abec5bfb98b30fd9f983257
SHA512

8776cdb2e9cbe7aeee9664e66fee5d271222b1fc79f29e48f8795b8a82d6b0740789094cf5cdb6a3492ad2957e389798ac9e755700ede308f5ea880fbfa91888
SSDEEP

393216:t5YopBYVcwMzwq/Ox1WkVeCdx+93OctbabqBEkXe5jFV:rUfAwqmxPVpX+oUby7ksjFV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	GarminMobileXT_5_00_60_S60_TW.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	GarminMobileXT_5_00_60_S60_TW.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	GarminMobileXT_5_00_60_S60_TW.exe
2576	GarminMobileXT_5_00_60_S60_TW.exe

C:\Users\Admin\AppData\Local\Temp\GarminMobileXT_5_00_60_S60_TW.exe
"C:\Users\Admin\AppData\Local\Temp\GarminMobileXT_5_00_60_S60_TW.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download