Overview

overview

10

Static

static

1844sase.exe

windows7_x64

10

1844sase.exe

windows10_x64

1

Resubmissions

09-03-2021 16:09

210309-7n13ybp6e6 10

13-07-2020 07:31

200713-tk9e1ynrne 10

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    13-07-2020 07:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1844sase.exe

  • Size

    332KB

  • MD5

    51373389a8df39b4101b69346e3ba336

  • SHA1

    022acbdec0f0fa53874aa959dccebe107d6b871f

  • SHA256

    c7552fe5ed044011aa09aebd5769b2b9f3df0faa8adaab42ef3bfff35f5190aa

  • SHA512

    d09efb3f00adacd97a46d9bbcbb9b0c2b7a78db66ad57e9491f8ad73d1c5b242b5e4248d61254058123e0d795dd95a7560cbb73252872ff2ebd79ace58f843fc

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 116 IoCs
    adwarespyware
  • Checks whether UAC is enabled 14 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1844sase.exe
    "C:\Users\Admin\AppData\Local\Temp\1844sase.exe"
    1⤵
      PID:2040
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:3464
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3464 CREDAT:82945 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Checks whether UAC is enabled
        PID:4048
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:82945 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        PID:3180
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:1008
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:82945 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Checks whether UAC is enabled
        PID:936
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:3804
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3804 CREDAT:82945 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Checks whether UAC is enabled
        PID:1868
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3924 CREDAT:82945 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        PID:3672
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:3956
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3956 CREDAT:82945 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Modifies Internet Explorer settings
        • Checks whether UAC is enabled
        PID:388
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Modifies Internet Explorer settings
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:82945 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Checks whether UAC is enabled
        PID:2024

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
      Download Submit

    • memory/388-8-0x0000000000000000-mapping.dmp

      Download

    • memory/936-5-0x0000000000000000-mapping.dmp

      Download

    • memory/1868-6-0x0000000000000000-mapping.dmp

      Download

    • memory/2024-9-0x0000000000000000-mapping.dmp

      Download

    • memory/2040-0-0x0000000002090000-0x00000000020A7000-memory.dmp

      Filesize

      92KB

      Download

    • memory/3180-2-0x0000000000000000-mapping.dmp

      Download

    • memory/3672-7-0x0000000000000000-mapping.dmp

      Download

    • memory/4048-1-0x0000000000000000-mapping.dmp

      Download