6ade76478fe8b9e3fe2f9ad6c2e9c82e8a43acd4aa0220b06e31ab2ae53cfc68

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FangDai.exe
Size

216KB
MD5

b8cd8f3982f2307908a99ac9366f8acb
SHA1

7359344d0db7ae49e641f1042d4d4e0cebd5f3e1
SHA256

672195e2567e856ddb23821ca4ad988273a8543d591f43e456d7bb60962321da
SHA512

cb46899b735b559f2e41cf1286872f3d7bd10af2ea9d551fe74c8236cfa78066e0017f3fbf92ae11f49f7a6b0052d4b9a4700f1c54a864bb956d7880c22f7716
SSDEEP

3072:1PceBI8gka0ZnyqOtmnXje7MOSmHGf6Pn0ZtXvl/SDW1UO11J1iaPd8YWa:1PQ+/ySnXj6sX6fQFNdU21FPd8YN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	FangDai.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	FangDai.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	FangDai.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2280	FangDai.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2280	FangDai.exe
2280	FangDai.exe

C:\Users\Admin\AppData\Local\Temp\FangDai.exe
"C:\Users\Admin\AppData\Local\Temp\FangDai.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2280-32-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2280-33-0x0000000000310000-0x000000000039C000-memory.dmp

Filesize
560KB

Download
memory/2280-36-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download