cea22277e0d7fe38a3755bdb8baa9fe203bd54ad4d79c7068116f15a50711b09

Analysis

max time kernel
94s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cea22277e0d7fe38a3755bdb8baa9fe203bd54ad4d79c7068116f15a50711b09.msc
Size

141KB
MD5

81d224649328a61c899be9403d1de92d
SHA1

f4895809cb38fa1f225340e99c05e477a5017111
SHA256

cea22277e0d7fe38a3755bdb8baa9fe203bd54ad4d79c7068116f15a50711b09
SHA512

17e0a744c9f9ecc2fb4080611c8e9932e884dbc53fe716541aff86137654fa357af0d4cb40bb4417c7d3d86a23210a4b204179eca816160bc80871fba60bc90d
SSDEEP

384:PLUjHaIvDfCbiiNPyVIB7nstz5R0iXV5qf:PCHtD6iiNPydzRJTqf

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	mmc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\IESettingSync	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	mmc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3984	mmc.exe
Token: SeIncBasePriorityPrivilege	3984	mmc.exe
Token: 33	3984	mmc.exe
Token: SeIncBasePriorityPrivilege	3984	mmc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3984	mmc.exe
3984	mmc.exe
3984	mmc.exe
3984	mmc.exe

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe "C:\Users\Admin\AppData\Local\Temp\cea22277e0d7fe38a3755bdb8baa9fe203bd54ad4d79c7068116f15a50711b09.msc"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...