Analysis

  • max time kernel
    129s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 20:58

General

  • Target

    4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe

  • Size

    1.2MB

  • MD5

    924db19b444d0416158d90bca8f62cb1

  • SHA1

    4571b8ae2f24c9a13efc0435ccb1281ef34ff8ce

  • SHA256

    4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac

  • SHA512

    f7ac4b33676b06780a75b7365fa2c9cf45e47a359786ec6949883e6bfd91b0ae489a806dbc6eaf57e6bcb706ce3bcebe1829b09bcd9522f132a3ec3bd25dbcc0

  • SSDEEP

    12288:/DMnvPg/Cr+jeEfijSpRoFRQa2Z7yqZX6kYud+ZPVPPDWV+hJ5Yf:L8A/6cRfij0ol2ttNYud+ZPp7p

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe
    "C:\Users\Admin\AppData\Local\Temp\4378be68a52cfa1b3234739c907b89d310847c6a313c9455ae8bf30ed2f1e5ac.exe"
    1⤵
    • Modifies registry class
    PID:1824
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:388

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0R2A1H7S.txt

    Filesize

    608B

    MD5

    48bc5806f4987115c1ca69eeb5489599

    SHA1

    3a479ca82db9d232c267cdc62d4827b23bd03ad0

    SHA256

    9899b45722310297bbbbd4a1468f01863ed8eda201a97bed5b6e3578d66bbd25

    SHA512

    8ac3cfa5644059d342673a60bfb955a656dd4b91a9571c67af13d44aee406b4abbde3e1ca592bef9b82fa47465f9c3b8503d3f38ee1599797d76739a3459eeea

  • memory/1824-54-0x0000000075571000-0x0000000075573000-memory.dmp

    Filesize

    8KB