Analysis

  • max time kernel
    154s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 14:06

General

  • Target

    test/main_temp.exe

  • Size

    2MB

  • MD5

    52bbc76cac35134534361c33a583b87a

  • SHA1

    45db17d6796da108f3f6bdb89f04365ae7d488ee

  • SHA256

    d26349b86c9428c0c18df9403b85d2443b866b0e7b99a4a1c8254bd0155326fd

  • SHA512

    9cb6821313018064887a635f74512d947a8425f7093f6284aab776d87eb3914b012156e51fce7f8911daf8d66fdeaa4e6206b3d621ed380c547a1c3c2d0bcbc1

  • SSDEEP

    49152:6MIov1vHrb/T4vO90dL3BmAFd4A64nsfJLi4GLCagOv8KIWnDD1codmS373a1WCE:zI8vTM3xDFLK1j4q6

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings ⋅ 1 TTPs 4 IoCs
  • Modifies registry class ⋅ 32 IoCs
  • Suspicious behavior: AddClipboardFormatListener ⋅ 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test\main_temp.exe
    "C:\Users\Admin\AppData\Local\Temp\test\main_temp.exe"
    Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Windows\explorer.exe
      explorer /select, C:\Users\Admin\AppData\Local\Temp
      PID:5036
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious behavior: AddClipboardFormatListener
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of SetWindowsHookEx
    PID:424
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    PID:1264

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • memory/5036-135-0x0000000000000000-mapping.dmp