6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe
Size

1.4MB
MD5

4da64683393035ace1144145c8215322
SHA1

df4b7be0743a653cfa414ef969c65980303e7c12
SHA256

6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217
SHA512

0d6a86e0cabbf770bd6581094c0c6356a3015e2dd0b509dc7668436f1c0ced6ed34e88291b82496fa371b61fe15a4c1d6ed29559b0ff024d368651a1fe161f9b
SSDEEP

24576:r/8qPMK/qT7VNeYv0+yAr6WwXYARKIOoLPUZ694ledSPFlBpokY3QoQ92vmz0:r/Lt/qfVN4O6tYB/sPUZxled2Pg3tvm4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ujf.foo	6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe
File created	C:\Windows\SysWOW64\ujf.chw	6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe
File opened for modification	C:\Windows\SysWOW64\ujf.chw	6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe
File created	C:\Windows\SysWOW64\ujf.chm	6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1732	6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe
1732	6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe

C:\Users\Admin\AppData\Local\Temp\6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe
"C:\Users\Admin\AppData\Local\Temp\6576500cbcda2146f695a791a58010205e0fca03f97790145a2fa16ed1cbc217.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download