e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe
Size

2.1MB
MD5

7fbd4fb00b711eb458c9901fbdc5d2a0
SHA1

91339fc759179da3695becd8f99884dcbf89fbc9
SHA256

e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70
SHA512

7fb510355b083d6634c8b6e6c51bd06c07b384ee692374d22218376e690064e9627cb6fa260dcf2d1138974c7b9caa432ff98acbaf401b842efea14087b9e4f3
SSDEEP

49152:/HzjmuuAnMcqfhtXXWdCwgrCTAz42xAINsEIU3B7uRNroUf5Y+O:/HzjCdfad7W42CINN8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\MuiCached	e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2308	e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe
2308	e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe

C:\Users\Admin\AppData\Local\Temp\e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe
"C:\Users\Admin\AppData\Local\Temp\e8f46f02e423ea332a5c6c68cf8ea1904dbd715174425cf96da004194618da70.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
2KB

MD5
88bb6be8d33e439089dc73d05ee56e32

SHA1
6a3a735131b0045d3eeece13386e9722afe56b73

SHA256
4d28349e4cac71f7fb1bae638a47ec48aa50b7ef4ab14042ebeb1c31bc03d3d8

SHA512
b5bf6f3f5d202b7d88b7e4603e3e4fcfa22b5661a2cb10218f658837ca4c73b77c6d3d40f328e5c7911e260185a9085d94634820707fcac3cbfc13a6d9af602e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
555B

MD5
74079fbd63d8766194751e788f9c140e

SHA1
616aa2f9ccaab8ef4ce8a2afe9f1f2d2a3396d86

SHA256
830997bc03fc50f615688f7e0d6807154069dd26748da4af0d275721bb4140b7

SHA512
197b22f86964eab695151b4620f862e4f35fc11e7f75ff087881843793cbab138c6e4809db6d76138b178b9186d5e78ae3aa97ab7267d4772c0f6952e62bc0a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
1KB

MD5
b3510a830410df64865ff679e47928c0

SHA1
e067230e7b1b3177c71522f31da86f8dcae70032

SHA256
0cb37da6f6e9d3abea68a7b2412928d34a7e1b95d0e0460635fd517c449c37dd

SHA512
66743852d84e3477fc6f9e160ecde342adaaedcb0213cb3cead773951f9653940fb8a70e2b77b41f435934223554bff73d69957e721249e94117cec479855b4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
3KB

MD5
12fcc899bb2cea021e54b18437da6da4

SHA1
f823978058f26b3a8cd5f3dbcb1f65a33264155b

SHA256
2c454230eabfb5d4e0518e3680665d609a3e24b86585bc32b27d8f53433080be

SHA512
2a9ab578c7381f09e993d655b359de45572c3ceef41298579f230b0269707b7c8a1b36f51269d5ffde16dd3545b6ea6e9c22f51a05e9cff009d4b3343afacc71

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
4KB

MD5
f3b79c5a8fa9e70d53a87d06345e029b

SHA1
bc01f474eef6ed2c8a6036fc9504632f89e05024

SHA256
bb651aaae17ae9539d7b2126fca23abc79be2ed4693b736b0d7cbeefcca352bf

SHA512
969b313c02cee7d143bf67dc6753f832679d54d551a8abeb22beea50904250f36133d3a020bf509ebefb937f4d46ca0d8222205eab4f526f642db90a8a30ee75

Download Submit