fe09fe81adf645827be671d31af92b0929ad9e4d34c655a6056b50d57907f4f5

Analysis

max time kernel
112s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65c7c12085ae6bffd38f3246536f6740N.exe
Size

770KB
MD5

65c7c12085ae6bffd38f3246536f6740
SHA1

acf642e58eee78f64ad82e67f2ec7a6659574f88
SHA256

fe09fe81adf645827be671d31af92b0929ad9e4d34c655a6056b50d57907f4f5
SHA512

23a69b78c80050adb1599d85191d299979686880ed07e9f3f8ba68776cba730cf8c96f5f850068e5e9e2d9e5aa8b5345c3d0647f2cf964723d43d6459366b838
SSDEEP

12288:wMAi00JcKpn053TAn8eEU56fTVlHjpE9pThnD7YMdK2Sd9trm03au0z:f00Jp0588eh5Oja9pTNDsSK2+tpjs

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	65c7c12085ae6bffd38f3246536f6740N.exe
File opened (read-only)	\??\B:	65c7c12085ae6bffd38f3246536f6740N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65c7c12085ae6bffd38f3246536f6740N.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	65c7c12085ae6bffd38f3246536f6740N.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	65c7c12085ae6bffd38f3246536f6740N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	65c7c12085ae6bffd38f3246536f6740N.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1936	65c7c12085ae6bffd38f3246536f6740N.exe
1936	65c7c12085ae6bffd38f3246536f6740N.exe
1936	65c7c12085ae6bffd38f3246536f6740N.exe
1936	65c7c12085ae6bffd38f3246536f6740N.exe

C:\Users\Admin\AppData\Local\Temp\65c7c12085ae6bffd38f3246536f6740N.exe
"C:\Users\Admin\AppData\Local\Temp\65c7c12085ae6bffd38f3246536f6740N.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bezier Tool.htm

Filesize
8KB

MD5
0704db48b606ab1dea19a8934b57cbeb

SHA1
eb9a918b15b1b9f774e0178fda8642694974b1a6

SHA256
fc4b6711e83be9d721b3e0469e5f6f33d05fb887481a205092fd00547950c4b3

SHA512
930507fe3e5c44c13513aa0a0d6988e8890d39551f6f1e999f96fbb2e3872e8b2b97dc260bdb922c8a5c410df1f1519a4f77b47c75bd2102012f1fdfb39a418d

Download Submit
memory/1936-0-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-65-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-66-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-67-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-68-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-69-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-70-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-71-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-72-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-73-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-74-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1936-75-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download