Analysis

  • max time kernel
    107s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2022 15:04

General

  • Target

    6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe

  • Size

    1MB

  • MD5

    448167188d4f47b825a5aa8c0ac12f3e

  • SHA1

    52706abe223080b9f905174ff3d1a1a35e3db081

  • SHA256

    6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6

  • SHA512

    97b970972b29d62c40a06b0d2cf06424c20cb7eb1b2fa199c39ed6f3c9b582e84f89ba3083d49d278a4342611a373e129842b385ed3f9c9d91860bf97e0eeafc

  • SSDEEP

    24576:QmO82iSkvu+T2tlgdW2fsJVlRnTR8GPPd6ZOJ6mYuCCN+R5KU:5O8bSkm+TgsW285n9bP+LZH5KU

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Modifies Internet Explorer settings ⋅ 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 7 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe
    "C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe"
    Suspicious use of NtSetInformationThreadHideFromDebugger
    Suspicious use of SetThreadContext
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe
      "C:\Users\Admin\AppData\Local\Temp\6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe"
      Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6e736c4bb791b83787d1866e1f286f52ab1a8fbc8a20d5061755b4ed7d99a2d6.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:540
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:540 CREDAT:275457 /prefetch:2
          Modifies Internet Explorer settings
          Suspicious use of SetWindowsHookEx
          PID:1032

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\E1J1YQUR.txt
                          MD5

                          f7552ba602a639c23ed1d86f169cb1da

                          SHA1

                          410ed7eca0a03142c612e3a7b96d916308f3545c

                          SHA256

                          b3ce60570ac57715e9bbb1e01213e7f9177072dea7be631430536ce1e97200cc

                          SHA512

                          62c786d9077be2b3530cc1344a22af04d243a577f9a528098212c85585ab1f3ea0a558d153c198babebdafc683bb743e751de704c0ced4e2affd9df9d933b741

                        • memory/1160-62-0x0000000000400000-0x0000000000454000-memory.dmp
                        • memory/1160-58-0x0000000000400000-0x0000000000454000-memory.dmp
                        • memory/1160-59-0x0000000000400000-0x0000000000454000-memory.dmp
                        • memory/1160-61-0x0000000000400000-0x0000000000454000-memory.dmp
                        • memory/1160-63-0x0000000000400000-0x0000000000454000-memory.dmp
                        • memory/1160-64-0x0000000000400000-0x0000000000454000-memory.dmp
                        • memory/1160-65-0x000000000044DC4E-mapping.dmp
                        • memory/1160-67-0x0000000000402000-0x000000000044E000-memory.dmp
                        • memory/1160-68-0x0000000000402000-0x000000000044E000-memory.dmp
                        • memory/1468-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp
                        • memory/1468-69-0x0000000000400000-0x0000000000729000-memory.dmp
                        • memory/1468-57-0x0000000000400000-0x0000000000729000-memory.dmp