d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14

Analysis

max time kernel
57s
max time network
62s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 07:43

Target

d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
Size

152KB
MD5

99ca819c8034e548bb138b4e5314c232
SHA1

32370c1ddd4bfb74a1bf195022001e68ff698a92
SHA256

d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14
SHA512

ea8a1493e7a5fe5ef7429413d2815bd02fc5762d5e8359922e7e60bb4d4f7f398dee3d7074d5d7307abcf74daf279bd30edadfed760b394024b1415f6489926f
SSDEEP

3072:EFe9ArAK3iYoKqdJd3IxL2DdKjbaOR5W9Inx2Kx:ZADwKFLFWSW5

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F5BDD97-6BE4-4d53-862F-33A21494CB0E}	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F5BDD97-6BE4-4d53-862F-33A21494CB0E}\Implemented Categories	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F5BDD97-6BE4-4d53-862F-33A21494CB0E}\Implemented Categories\{789EBD95-F0B6-48b2-B05B-124341EAC6D9}\UUID = "ADF4D85C4EA3429aA6E76CD736A87094"	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6F5BDD97-6BE4-4d53-862F-33A21494CB0E}\Implemented Categories\{789EBD95-F0B6-48b2-B05B-124341EAC6D9}	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1672	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1672	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
1672	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
1672	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe
1672	d9cdac9d2efbdd9545dfba4da069ddaa001e23228ab97c6c736447e2a16f1d14.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download