849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef

Analysis

max time kernel
153s
max time network
169s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-10-2022 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe
Size

471KB
MD5

734ed36c4ec735963fd147bdb57d2b40
SHA1

180303531417fa1f28a00a839b68dd02e4d1a33f
SHA256

849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef
SHA512

57f343aa6c3b3283497cda5b0df441c9d67a6c60da11498c22fc7705abb6b407c11c1d1913eedb4951afe557e4ffb217160ff7ef373c4c3ef1ab6a85e4e2ef46
SSDEEP

12288:xcN1zZoi11kIDIFmgzniA1EG3kUQymK9Dloj:uZoiPBDIFniAuG1I

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1716	tvsliabumveefmz.exe

Loads dropped DLL 2 IoCs

pid	Process
1224	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe
1224	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	tvsliabumveefmz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	tvsliabumveefmz.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1716	tvsliabumveefmz.exe
1716	tvsliabumveefmz.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1716	1224	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe	28
PID 1224 wrote to memory of 1716	1224	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe	28
PID 1224 wrote to memory of 1716	1224	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe	28
PID 1224 wrote to memory of 1716	1224	849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe	28

C:\Users\Admin\AppData\Local\Temp\849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe
"C:\Users\Admin\AppData\Local\Temp\849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe
  "C:\Users\Admin\AppData\Local\Temp\\tvsliabumveefmz.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
471KB

MD5
734ed36c4ec735963fd147bdb57d2b40

SHA1
180303531417fa1f28a00a839b68dd02e4d1a33f

SHA256
849897091c1435ccc0901728e8300c30993903c4da840c302721dc41cea79aef

SHA512
57f343aa6c3b3283497cda5b0df441c9d67a6c60da11498c22fc7705abb6b407c11c1d1913eedb4951afe557e4ffb217160ff7ef373c4c3ef1ab6a85e4e2ef46

Download Submit
C:\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe

Filesize
19KB

MD5
27b5e4d4fe804e60cc6d7f1a1f9e8c04

SHA1
9dfe639b3cc4dfd44d9537a0bca46fd39b3dbc52

SHA256
f212f6658340c5d81b686866afce671cb71d2f0308d9f1e31b7ee01b74c84eda

SHA512
275c865d05c98bbf60c29b40978586a91569471217fa2ef5d44741ac1a535f5e0295e1e2f666e8ddaaa6e7dcf3cd869a41ed62481e0da9541fdb63bc0db6cee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe

Filesize
19KB

MD5
27b5e4d4fe804e60cc6d7f1a1f9e8c04

SHA1
9dfe639b3cc4dfd44d9537a0bca46fd39b3dbc52

SHA256
f212f6658340c5d81b686866afce671cb71d2f0308d9f1e31b7ee01b74c84eda

SHA512
275c865d05c98bbf60c29b40978586a91569471217fa2ef5d44741ac1a535f5e0295e1e2f666e8ddaaa6e7dcf3cd869a41ed62481e0da9541fdb63bc0db6cee7

Download Submit
\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe

Filesize
19KB

MD5
27b5e4d4fe804e60cc6d7f1a1f9e8c04

SHA1
9dfe639b3cc4dfd44d9537a0bca46fd39b3dbc52

SHA256
f212f6658340c5d81b686866afce671cb71d2f0308d9f1e31b7ee01b74c84eda

SHA512
275c865d05c98bbf60c29b40978586a91569471217fa2ef5d44741ac1a535f5e0295e1e2f666e8ddaaa6e7dcf3cd869a41ed62481e0da9541fdb63bc0db6cee7

Download Submit
\Users\Admin\AppData\Local\Temp\tvsliabumveefmz.exe

Filesize
19KB

MD5
27b5e4d4fe804e60cc6d7f1a1f9e8c04

SHA1
9dfe639b3cc4dfd44d9537a0bca46fd39b3dbc52

SHA256
f212f6658340c5d81b686866afce671cb71d2f0308d9f1e31b7ee01b74c84eda

SHA512
275c865d05c98bbf60c29b40978586a91569471217fa2ef5d44741ac1a535f5e0295e1e2f666e8ddaaa6e7dcf3cd869a41ed62481e0da9541fdb63bc0db6cee7

Download Submit
memory/1716-56-0x0000000000000000-mapping.dmp

Download
memory/1716-59-0x000007FEF3EF0000-0x000007FEF4913000-memory.dmp

Filesize
10.1MB

Download
memory/1716-60-0x000007FEF2C10000-0x000007FEF3CA6000-memory.dmp

Filesize
16.6MB

Download
memory/1716-62-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Filesize
8KB

Download