Analysis

  • max time kernel
    150s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 06:44

General

  • Target

    fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe

  • Size

    208KB

  • MD5

    0a6ad25f8f0f2b4633f52a363025e5d1

  • SHA1

    ffac6af75164b16ec7c376314ef317dc02a608c5

  • SHA256

    fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e

  • SHA512

    7b7796eb2cad9883c99a3f8f0778532240fb708f0c6c9ec0439626a5b326d4828f273eaa54f4bd8f6e316e6cf3104cbbd53abb918acc8af66d86c4730e819e4a

  • SSDEEP

    3072:8XNtb9fQZn/jMTnORtoV2oR680sQewQbmJMM1rA+8B:8L9oVIFV2oR93wQU1AZB

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe
    "C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe
      "C:\Users\Admin\AppData\Local\Temp\fddec45a5ea90ff0162fda418685d885a10416ee93860b08e2645896f4cf0d9e.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3244
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3244 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4748

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2284-132-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2284-135-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2800-134-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/2800-137-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/2800-138-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/2800-139-0x0000000000400000-0x000000000044F000-memory.dmp

    Filesize

    316KB

  • memory/2800-140-0x0000000000700000-0x000000000074F000-memory.dmp

    Filesize

    316KB