1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe
Size

132KB
MD5

3a2f343e8cc6ac6a962b0c256d683116
SHA1

53000b80f400e2f6a36e417b3617d0a209ed3c9b
SHA256

1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a
SHA512

017c333c1f869cabad49961f2c71f0b62cbf5b0c71aa368cfc06ba8da00508a2287e47a08c797af37197206a07b79467e6ad487ab52c23c7ec27d3c6ea5aa5a9
SSDEEP

3072:n19s6Yb6Zc7qY0a8AHmqu52ZrXZS1qNMjLyfn3upqFzPbeCUfV:1qb6K7qta8AGqWArXZkjuf3upmjSCsV

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1476-54-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe
File created	C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job	1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1476	1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1476	1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe
1476	1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1476	1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe

C:\Users\Admin\AppData\Local\Temp\1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe
"C:\Users\Admin\AppData\Local\Temp\1a4511a3aa6fdcf9274cd38ebdb00e0e5501c272b0bb4f5e33920d2e4b55395a.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-54-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1476-57-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1476-58-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1476-59-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download