996cd49012b3c6646b0cbedfb4f42086ca6acaa4c4b2544d4170dd0560f92ba7

Analysis

max time kernel
133s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugins/MyWeather/MyWeather.exe
Size

156KB
MD5

ac2e8c8a3d1142784d8a3f3cd2644d55
SHA1

64be1f247514bd6e4deea771b9ee45fc2c0906a8
SHA256

530b5c41064716590b5394a18a7fcb627d9d322f65fe96ed1438fcdf322bbf2d
SHA512

89b94c8f78a8bb48e01d33769c37f7b535f57a78abf75723c8cee104987b0a9f15ef9e4a7ff9ceba8bf9fdb4c091e0b15688eefdc44da0ab1fb7fc180777956c
SSDEEP

1536:54L3IXNjSpGjqySr5zFzAdVrWMkf0fvltMlKvYg6+77nsj+DsxzBCKDta:G28poqySr5FAdVZkf0fNrD6Mcg

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MyWeather.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	MyWeather.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	MyWeather.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\IESettingSync	MyWeather.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	MyWeather.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1624	MyWeather.exe
1624	MyWeather.exe
1624	MyWeather.exe
1624	MyWeather.exe

C:\Users\Admin\AppData\Local\Temp\Plugins\MyWeather\MyWeather.exe
"C:\Users\Admin\AppData\Local\Temp\Plugins\MyWeather\MyWeather.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Plugins\MyWeather\tmp.htm

Filesize
893B

MD5
4d1793bc3892def58bafec06c1df14ce

SHA1
e7b0a4a07478b4c34af8f75aff0fae06f35d2b47

SHA256
fd4634a444d477bcff2724adf57c959d00a2f8d011f73b9a1aada9a69bb0d06b

SHA512
57c913bfa59f55f6290f2c8c5e66cffcba65433ba9c6acd610920c9243c10f7377319189811b78dba0eb21856b0c27c43f95b3967b6e16648549e893bb0b9777

Download Submit