817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a

Analysis

max time kernel
77s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Size

147KB
MD5

18d831f3f8aeef194e062d93a9e04212
SHA1

7cbb0afb5a9367195bc12a02d5b2ea4cf1736b7e
SHA256

817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a
SHA512

9122a863c89e02eb18454303e6c4d38efdb57f07830cf23c2bc85edae3c12b6e0028f3bfa7c46f612302dcd12a5c5b3e851aa6dac5e9b18bcee45ab349932afa
SSDEEP

3072:539dAiT5+jQeZiY0Jj2xssmFsDKMeHPTJpp70NWkKJDZXYUVwPH:1PAi7WiY04xKjpxeU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet explorer\Main	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.87265.com"	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" http://www.87265.com"	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2200	2060	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe	84
PID 2060 wrote to memory of 2200	2060	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe	84
PID 2060 wrote to memory of 2200	2060	817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe	84

C:\Users\Admin\AppData\Local\Temp\817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe
"C:\Users\Admin\AppData\Local\Temp\817ab63bef2485ba5fc0f2a3003043d251882c04b5e015f45839c517d304083a.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\twuesg.bat
  2⤵
  PID:2200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\twuesg.bat

Filesize
248B

MD5
d729d917178e112289bf6c21c0a7fb37

SHA1
6ae9b48d676159435a60ea03af053df68ba1101c

SHA256
de310de831a8e251c913c9aa7e9c99ca3e15652e9f52ce159c63af6d6dacee27

SHA512
cc535441c1383297aff640ddd7a65d9e8b9738314f30fece293d796ca544c56b14eddc7d2e38c256abf2ec2d36e30ed457c9b591b75495ba9d0c620e0e481bf1

Download Submit
memory/2200-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads