149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee

Analysis

max time kernel
124s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe
Size

158KB
MD5

a0b03b4dde45e29e975a5a6cebbe298f
SHA1

2efe249714ccf09095034fbde999d87814eb6d6e
SHA256

149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee
SHA512

e727799135ad78c81be39cc8c1b1b046721483851df2032fe73d7c05eba916f3f6e1ddeb59c2d09d686c72a7fecfd09e7ba419e6a55849ec59fb9cc57ad472df
SSDEEP

1536:yvXgM8jLIVnW3rGq1zPHzsLRz1zV+7XAG+C:ygM8N33PAV1p+7X3+C

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.2345.com"	149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4512	149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3376	4512	149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe	85
PID 4512 wrote to memory of 3376	4512	149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe	85
PID 3376 wrote to memory of 4604	3376	cmd.exe	87
PID 3376 wrote to memory of 4604	3376	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe
"C:\Users\Admin\AppData\Local\Temp\149ff867723e2602465854b71d55e7c5a3cb4352d3607ef03a2d1921a592e3ee.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Compress-Archive -Path "C:\Users\Admin\Desktop\*" -DestinationPath "C:\Users\Admin\Desktop\tax.zip"; $password = 'tax'; Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; $zip = [System.IO.Compression.ZipFile]::Open('C:\Users\Admin\Desktop\tax.zip', [System.IO.Compression.ZipArchiveMode]::Update); $zip.Entries | ForEach-Object { $_.Password = $password }; $zip.Dispose();
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Compress-Archive -Path "C:\Users\Admin\Desktop\*" -DestinationPath "C:\Users\Admin\Desktop\tax.zip"; $password = 'tax'; Add-Type -AssemblyName 'System.IO.Compression.FileSystem'; $zip = [System.IO.Compression.ZipFile]::Open('C:\Users\Admin\Desktop\tax.zip', [System.IO.Compression.ZipArchiveMode]::Update); $zip.Entries
    3⤵
    PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...