9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
Size

691KB
MD5

f47b2a370c0ba8d26c2503c80b1d21d0
SHA1

ead66fbb5314d5bb4cb8735f14cc1494d895b2a0
SHA256

9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865
SHA512

f3ae49c30eb1323b067ddf6590fe2e6eca52864898bbd2ec2a3778185d8ad93dae32e210a8294ce5247355ddaf8047d8b11acb9dcbdf7cfbfe5e256115889b57
SSDEEP

12288:AmJehr12dOApfdNhHXPRPNwH6zZ51wBL4ydquTHYU3FkbYeAirGAKQIB65JHZR6L:AmJ22QglNhfR06zZ0V4yQAHxMYenRKQM

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2120	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
2120	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
2120	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
2120	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2120	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2120	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
2120	9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe

C:\Users\Admin\AppData\Local\Temp\9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe
"C:\Users\Admin\AppData\Local\Temp\9637503226fae7e5ef5c6fb1ebb523d335ffac22a3410b1648763145380ab865N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjE053.tmp\eula.ini

Filesize
2KB

MD5
934daeabfc74e960db0627f7dae0f00b

SHA1
28ed8ce5c3bb048d73b6d41e829358c0e7057460

SHA256
a352cef6b5c051831ae3e78f70e358b115c1b80cfd8751b6bd7f67b37c36ec40

SHA512
ee240f4c4bb21007ba8658a2d2912ee21e0a388cd0c7af4e69c56826aafaab97fdf78fb9bcb8d666821f8f70303a1e9ab04007b97b17f6345a45baa5dea59fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE053.tmp\eula.ini

Filesize
1KB

MD5
fc6e97c076027185f1970a924c00c6b5

SHA1
4b2aa2968a97461c47382d8d4cd050779e3f2071

SHA256
f56476bf17d592c385104c8fe87d49c3eacbb1836378867535aaebbb1396c7e3

SHA512
7b2e34076c93cf6d0ab14558a8c7b9601c1c34052e41b3ff9674712611f6aaaffc1181cfb835b9a23b9fa3600426901d89c1e5b1ff029c4b0a842f0a1e526ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsjE053.tmp\eula_fr.html

Filesize
24KB

MD5
99b50694be285399c3022d50d78faa9f

SHA1
d9374ec113a3431361cdb4a7b43e0e6037b2a438

SHA256
4cac15569e87744b1464ce273d56546d91312c8c7f68ccbc6deb762c0838bff0

SHA512
7cfc06b5e38e80a95cfd9aede1ef68c635045c9c8930953c45909efcf4924615fc18f8b954a1c4a56e868748dd93338e67e56f2d6314068e997d4c8f85dc4167

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE053.tmp\InstallOptions.dll

Filesize
15KB

MD5
6e663f1a0de94bc05d64d020da5d6f36

SHA1
c5abb0033776d6ab1f07e5b3568f7d64f90e5b04

SHA256
458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4

SHA512
2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE053.tmp\System.dll

Filesize
11KB

MD5
b9f430f71c7144d8ff4ab94be2785aa6

SHA1
c5c1e153caff7ad1d221a9acc8bbb831f05ccb05

SHA256
b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655

SHA512
c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099

Download Submit
\Users\Admin\AppData\Local\Temp\nsjE053.tmp\installhelper.dll

Filesize
127KB

MD5
91b0372096274dbd47395aa8b28ffedb

SHA1
05d79ba090439c2898d8ad480355c08091acee55

SHA256
0411ab18ecb0d3d6292eabb89b4c8e41112b3e0be272b087555c2cb8cb0bfc28

SHA512
c40b9eace25b6c871eee9b4186181268de7463c4fe1c4c19372413989489fa891ebd528175d15df031dc768613a81c619acce0981a4c29d475e795d18b1aff08

Download Submit
memory/2120-15-0x0000000000680000-0x00000000006A3000-memory.dmp

Filesize
140KB

Download
memory/2120-158-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2120-186-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download