b8297a67fa973cd8bc65443c81b4e806b868160b4c63866e9f5d7370f50da015

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MyIE.exe
Size

358KB
MD5

bcd7559d89122857710a4706aa863c1f
SHA1

188b1733ca4e1bf4fb397ca9c5116e6ee0a15565
SHA256

1ee9d1297fec6cb9ef980bbb64299d3dfdd9666c902f3f10e75109fc412a98a0
SHA512

d9b1cd3401fecd98306c0a5bd2f5ed77c89548aa6fb1fd6d5aedd6ae16c9292d341648482c86750be822d08c1ac74cc5e362fdf8da4945d8a0e96605c97248d4
SSDEEP

6144:teXziNWP7iYb4hqu0ADwgKGTfRYD+yHM6ql4W9FFzYGqNrMLIija4C8Ty9Y8m7Mr:CjXcht/DTRMlql4uFFzYGAg8RhPmrysg

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyIE.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\TypedURLs	MyIE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4460	MyIE.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4460	MyIE.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4460	MyIE.exe
4460	MyIE.exe
4460	MyIE.exe
4460	MyIE.exe
4460	MyIE.exe

C:\Users\Admin\AppData\Local\Temp\MyIE.exe
"C:\Users\Admin\AppData\Local\Temp\MyIE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\User\Filter.ini

Filesize
630B

MD5
1299ad6d6c569794c821e57a6c421483

SHA1
14d51d2034637a7606d8caf67df06fe4db7299f0

SHA256
02fb895adcbaa2f8e40e0ecc4681e21fb86aa382e034b69e8536cc3e4bf56e0c

SHA512
49b4c2736e9940a2cef1766e503720721a80e5b7d39a4e48c0eac64862f8f7b711c9895efc9b4723033e25adbfe3c13ed28b3be78c35664add7ce08c836447b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\User\MyIE.ini

Filesize
1KB

MD5
ee8823653bd267071a0a6bede8e0abc5

SHA1
f68422bba614f09b9a4d37cc34f04319b04ba73e

SHA256
ec6d2badd750cea1b118c36d8901e7dda93c1869cce6951bccd662a7170936be

SHA512
d6f73bb982377b731c139188017c61366b56229e3d3e4cf56b093850c1034e2b4631ade63a06a56695c9012d5e9c0a9909df048ec0bc438f53a25ae37b13126a

Download Submit
C:\Users\Admin\AppData\Local\Temp\User\MyIE.ini

Filesize
1KB

MD5
28cad08e4902ac8bb3c4b30d4cf958b9

SHA1
18aea8fdb177589f59fac79224b399fd3a5deb39

SHA256
0c4f9d504b8b445c5e04b5b007e4b28d1efec9a4889bf8ae3c089fde78fececb

SHA512
52f1d2c177604107aacec8235b7519962ef3194afdd031c3ec941df9bcd6ed0d56169209b85aded72699d1218397af26a9338c35984126f8e65a134d249f8c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\User\MyIE.ini

Filesize
1KB

MD5
a16768b8e46d163504a4036d5499831d

SHA1
605d05e13e82d2320492b5b848075c81958c115c

SHA256
118118579679406e11852b21bceede09ee5c1603dc2a4be3b213772f5e3af626

SHA512
d9ee21cca315bb57d53672f37446911f74b088244ff45cf606e07e4634ae860ec2ebfb9f48f55c0f60f6a11383c049db2e0fafe724bd30416109fb769d3d6843

Download Submit
memory/4460-0-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download
memory/4460-413-0x0000000000400000-0x00000000004FC000-memory.dmp

Filesize
1008KB

Download