d32594a40b9c4135753c2dd2705c956e1c4edb030346177286a93f9d61256ded

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

žż.exe
Size

408KB
MD5

00066b266dc4509fb4c9d6f27f70014e
SHA1

0abf2a7cb060929a70ff4ac508729a513d58666a
SHA256

5f37d3ed3d4952504b0fe3e322b233bf3d5697457afee72c71387979905bc1ee
SHA512

06a1abed0de35955405684d1414918ec3ee2ffc0da1b083dc62b77c9249bdcba748828ac86d5072b1115e501a092daafc5d62e204225d2cf25402e0aa541b8b9
SSDEEP

6144:tMT8bfxe0SpdSBAr8pl7Sv2VBuLZhTujeWl0gkEesLBFFi4/jNwydRlNYtRC:2oJSpUh/sS66YmvljfRlutE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	žż.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2960	žż.exe
2960	žż.exe
2960	žż.exe
2960	žż.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2960	žż.exe
2960	žż.exe
2960	žż.exe
2960	žż.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2960	žż.exe
2960	žż.exe

C:\Users\Admin\AppData\Local\Temp\žż.exe
"C:\Users\Admin\AppData\Local\Temp\žż.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2960-5-0x0000000000220000-0x00000000002DE000-memory.dmp

Filesize
760KB

Download
memory/2960-4-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2960-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2960-2-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2960-1-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2960-0-0x0000000000220000-0x00000000002DE000-memory.dmp

Filesize
760KB

Download
memory/2960-6-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2960-27-0x0000000000400000-0x00000000005CD000-memory.dmp

Filesize
1.8MB

Download
memory/2960-28-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2960-29-0x0000000000220000-0x00000000002DE000-memory.dmp

Filesize
760KB

Download