Analysis

  • max time kernel
    161s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2022 15:30

General

  • Target

    5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308.exe

  • Size

    2MB

  • MD5

    656436ec2c07053b199a19730a74283d

  • SHA1

    ff2b556a5fa2f0c1de17698a52fde3589607877b

  • SHA256

    5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308

  • SHA512

    07337ac7fcc5529a99b52c97facf554f61a9483ee40d8ca5375607858111b1abd1f10dab66cbf4829d3f9308925267429fb1285e9434d3f65658927151906c03

  • SSDEEP

    24576:IlVCxwY7fti7Hb3Z4e4VtHvtftQih8ESwSMP3/R6pjl:IlMw6tij+eGHhtQiqZjyRSJ

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Modifies Internet Explorer settings ⋅ 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 7 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308.exe
    "C:\Users\Admin\AppData\Local\Temp\5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308.exe"
    Suspicious use of SetThreadContext
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Local\Temp\5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308.exe
      C:\Users\Admin\AppData\Local\Temp\5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308.exe
      Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5f8e7c1b4fd87cfbff41369dc163e651a7d016c0f53d496867a76ccfee77b308.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
          Modifies Internet Explorer settings
          Suspicious use of SetWindowsHookEx
          PID:1080

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\M69549OF.txt
                          MD5

                          a547356396c29afe93abea210a153153

                          SHA1

                          77f31698d468847e32a9e692ea2f9835687e4f59

                          SHA256

                          2c26f0f776627ffa8a5345f7631e5ed780f075c511fab5e4845f170a4c2b9e60

                          SHA512

                          7376cad555092ad2d5dc48e8cc04e2a1c260ae1bb93584ab25ba3326576d322b95d1f2250d271bdca8df05ea04186f30af6fb8a571b092051ac25a593e427ce2

                        • memory/1772-56-0x0000000000400000-0x0000000000474000-memory.dmp
                        • memory/1772-57-0x0000000000400000-0x0000000000474000-memory.dmp
                        • memory/1772-59-0x0000000000400000-0x0000000000474000-memory.dmp
                        • memory/1772-60-0x0000000000400000-0x0000000000474000-memory.dmp
                        • memory/1772-61-0x0000000000400000-0x0000000000474000-memory.dmp
                        • memory/1772-62-0x000000000046FFF2-mapping.dmp
                        • memory/1772-64-0x0000000000402000-0x0000000000470000-memory.dmp
                        • memory/1772-65-0x0000000000402000-0x0000000000470000-memory.dmp
                        • memory/1772-66-0x0000000076DC1000-0x0000000076DC3000-memory.dmp