Analysis

  • max time kernel
    106s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2022 21:02

General

  • Target

    d0a8906edead7eccbf439535774e7ba046d5054cd8a09e21722de7f8227ace35.exe

  • Size

    15KB

  • MD5

    6deeb6f66a0b6fc6ad3cde4b267ad100

  • SHA1

    4aac81fdbe3c16c3c3ca442e4303a7a358d5dcf4

  • SHA256

    d0a8906edead7eccbf439535774e7ba046d5054cd8a09e21722de7f8227ace35

  • SHA512

    74ed6905985401065d6774dbe750bf89638c9f2c1560486a90164109a756e640ff368b0594b8ea5817a47e54e2de59bfe73f3ae0582572d5bc52a822cb8a3292

  • SSDEEP

    384:EYWmpH2Wwg5JP1hPXoFZJAi4sk2gjIqXyi:3tFrXI/Ai4Z2yIM

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings ⋅ 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 6 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0a8906edead7eccbf439535774e7ba046d5054cd8a09e21722de7f8227ace35.exe
    "C:\Users\Admin\AppData\Local\Temp\d0a8906edead7eccbf439535774e7ba046d5054cd8a09e21722de7f8227ace35.exe"
    Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d0a8906edead7eccbf439535774e7ba046d5054cd8a09e21722de7f8227ace35.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        PID:572

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PN9VBE7V.txt
                          MD5

                          7d5cc084eabbfbd12edb7236666973be

                          SHA1

                          92eebd963b6be872cb8c06adb2b94793e78c5488

                          SHA256

                          75899321439c080dd5f9d7a75a0e009cada66abd68acb45f80d10cd0e2291160

                          SHA512

                          5bb7ddc5cebebd6390ea7d604bad039f26c96acc750ce772951d789fa5b25b3640f72125a96d8999fd8c9373de3ecbf560d215f9d664c877a971979aad44efad

                        • memory/1600-54-0x0000000001220000-0x000000000123C000-memory.dmp
                        • memory/1600-55-0x00000000752B1000-0x00000000752B3000-memory.dmp