328449250e95af61e5e92254665d4c1a43d835482cd2d159c1e8a08a1ad8c725

Analysis

max time kernel
106s
max time network
17s
platform
windows7_x64
resource
win7v20201028
submitted
24-11-2020 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
Size

965KB
MD5

613eb0c25564d774d81d1e4a96fd49b4
SHA1

39517f6689a4fc87df0b014fd163a2d291379e8f
SHA256

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536
SHA512

b8caa329c7ce7cd18a9fee3201bd3da8ba531e88e9049ff93c0dde4c198569a17debda7388c652d2bb486f71a7612fd709e52642ce68406791ec6114030aee0a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

pid process

912 c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

pid	process
912	c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
912	c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe

C:\Users\Admin\AppData\Local\Temp\c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
"C:\Users\Admin\AppData\Local\Temp\c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:912

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x000007FEF6580000-0x000007FEF67FA000-memory.dmp

Filesize
2.5MB

Download