fa8ff6cd1cf26f4e9ee26e68cd7e764f572e9845ddbd0ca305ada1beaca97ccb

Analysis

max time kernel
141s
max time network
67s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BounceOut.exe
Size

1.9MB
MD5

17b4e24e5393178e4defb1dde4e51e97
SHA1

6b28d115719e84cc4bf6595ddd7114e45e7cf7f9
SHA256

ae8c8c359d8d017133d8d02d0a2df0df49ac17a580942b531cb15851e4a43368
SHA512

de0781bb4aac834a8611ac6c1becc63ee746b53cd126622cded0ce5214c14285b02142df063614b5de57f452c3827919720084cb36caa60c8e448257107ea293
SSDEEP

49152:vi5cXY42x4ACp2ZtcO8ZEMZoWY+KGemSejTBgUUFZaNhMbus5QvF2:Ico42+1p2Lc4lWGjejTi42lmN2

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BounceOut.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	BounceOut.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	BounceOut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	BounceOut.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1040	BounceOut.exe
1040	BounceOut.exe
1040	BounceOut.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1040	BounceOut.exe
1040	BounceOut.exe

C:\Users\Admin\AppData\Local\Temp\BounceOut.exe
"C:\Users\Admin\AppData\Local\Temp\BounceOut.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-0-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-1-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-8-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-13-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-11-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-10-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-9-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-12-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/1040-14-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Filesize
4KB

Download
memory/1040-29-0x0000000003DA0000-0x0000000003DA1000-memory.dmp

Filesize
4KB

Download