7a8d168bb1256401fdac6fa662956a1e7c01e2f399bba8b193081e588869af9c

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

֮.exe
Size

1.1MB
MD5

331810e9f6de0679e9cd337aa026aab4
SHA1

88cbc6a80afcfdd2d5506d8f73ca889a669c5eed
SHA256

7c06daa6628997c39580b86e9601ee35c7e688efe0079d11517310f6433911cf
SHA512

5c82f7a497519d8a466d898701c210c27908d12ec9ff0dae56e121b574551648fcbb30d2af0c8e2bdb9b3fc1f86801bdea0fe23858b721a61905eeabcb59e55d
SSDEEP

24576:oWTeo4A7fKVV/NeK2TYIT4/oFaASoA6Vfnw:dTeq7SH/yTYIT4QIoA6Vfnw

Score

6^/10

discovery evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	֮.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	֮.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	֮.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\֮.exe = "1"	֮.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	֮.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\֮.exe = "0"	֮.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1628	֮.exe
1628	֮.exe
1628	֮.exe
1628	֮.exe
1628	֮.exe
1628	֮.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1628	֮.exe
1628	֮.exe
1628	֮.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1628	֮.exe
1628	֮.exe

C:\Users\Admin\AppData\Local\Temp\֮.exe
"C:\Users\Admin\AppData\Local\Temp\֮.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\twcache.ini

Filesize
134B

MD5
ad554b96d89f47b2cacc8a96694a6335

SHA1
89451393bcb908d8af851f7fbe845a31e3afa0a9

SHA256
494ff9fbb10590cb66a7c24d274ea78a78f8bd62f8e52fdd00f48811cac02407

SHA512
18f14e2dbe0470d01a1bbcb952ee6b52f651f7df32e2a56d3c40acf1f3936418d25116c9d59f669fdbc6904fc227a60d3eb02742164048b8e49944220a99c181

Download Submit
C:\Users\Admin\AppData\Local\Temp\֮.ini

Filesize
7KB

MD5
a158daf52fb091120dc7b4824a75111a

SHA1
26c9a167ef8ca2169c6c09e674697361f86b83d9

SHA256
bca1de78892c4ecfc9b5bace2798e844b3e19005eae7c69ba6453a09d7788832

SHA512
9e45bbe7a56fa54d5e3c081b2d79a21f3059275d0e81c50c08e8a04de3f52b638063adf22a7a3afb469f94b65bf5312030b04b47d47d2c57ed612bccd4b4106d

Download Submit