dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403

Analysis

max time kernel
58s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe
Size

144KB
MD5

671aecb89c310d2c91243242403f09ea
SHA1

dbeee44163c6a0d359867d5b7ecfad1d9169c1b1
SHA256

dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403
SHA512

cff1864fc27eb9b67806e199c7f00e103478e1d7486776986f4e36338edbb863fdfb1eabbf9a1196459fe0a71be3e23ba37e4f2710fa5c672394b3c8dc08613f
SSDEEP

3072:8sbqwbL5PQJ1IB+o0TfLkLreyB0wJDG0:RmwbLyn3HgLU

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe
File opened for modification	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\International	dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1032	dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe
1032	dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe

C:\Users\Admin\AppData\Local\Temp\dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe
"C:\Users\Admin\AppData\Local\Temp\dbb034be646807129236c1c757041b1a4d32c7df9eff0ff0d0ab080673c19403.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1032-55-0x0000000000460000-0x0000000000483000-memory.dmp

Filesize
140KB

Download
memory/1032-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1032-57-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download