3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6

Analysis

max time kernel
84s
max time network
202s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6.exe
Size

540KB
MD5

93b977f65596aafd0b02a5f52b3f6c80
SHA1

28575273f06be6809454db2415a9f544d54d6020
SHA256

3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6
SHA512

c3a96279c91f5515348fe7054b5244d4d872521765c6f0a4534f1f716fe11994fc273fd57e667d67cc69a2b2271dbc068e0ed5cb1d50b11481f3f86228d39c88
SSDEEP

12288:KpJ1087WDeFos2EYDqxjD+Xz+/UgF0nd2DFNmJf9Jj:Kv1t5Fos2cNDwisgCdeFwR9Jj

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-55-0x0000000000400000-0x0000000000561000-memory.dmp	upx
behavioral1/memory/2036-56-0x0000000000400000-0x0000000000561000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2036	3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6.exe
2036	3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6.exe

C:\Users\Admin\AppData\Local\Temp\3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6.exe
"C:\Users\Admin\AppData\Local\Temp\3a78459ac7f3684e76d7e3ff287549bc537a06c49af7525eb7c61ba57f1becc6.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000076871000-0x0000000076873000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/2036-56-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download