Analysis

  • max time kernel
    123s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2022 01:25

General

  • Target

    4f01ff0ec4d8b4f554ee663aecb26905fabf9bb6d10e4153c116476ce1fdfc75.exe

  • Size

    701KB

  • MD5

    0450c16a6a4642d0f66370ee91b505e6

  • SHA1

    f0aeeed72ee848b8948361b87c3c11b454c79d9a

  • SHA256

    4f01ff0ec4d8b4f554ee663aecb26905fabf9bb6d10e4153c116476ce1fdfc75

  • SHA512

    6cafdb17dec5cbd896b781e745c6a8a325263ad917d2df9deace7bbf1b1b8682b48702514eb78c92efd5e17da54e193844f8d666a289f3e21e037a05009f92d3

  • SSDEEP

    12288:mERVq31AQHW3W4KlqckjwfIVLUG7f2wx/hCzJjiBKTB4z33TMaZV:33qeG4KUchcB2PK+4r3TMqV

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f01ff0ec4d8b4f554ee663aecb26905fabf9bb6d10e4153c116476ce1fdfc75.exe
    "C:\Users\Admin\AppData\Local\Temp\4f01ff0ec4d8b4f554ee663aecb26905fabf9bb6d10e4153c116476ce1fdfc75.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\program files\internet explorer\IEXPLORE.EXE
      "C:\program files\internet explorer\IEXPLORE.EXE"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:916
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:916 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1404

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QTC6S4IH.txt

    Filesize

    603B

    MD5

    bb8b62b342b373b4aac1489812ec6af4

    SHA1

    be84ccb1de424ea1e8868358291b415a961e4fdd

    SHA256

    9de975d3a80a597495b575c148d9f42556c3ad3cfdbba2a9c4f8673169d706ef

    SHA512

    280bda745233503b09fcfde4d680da874ed93dc5c8b0835a3e77e39be498aec971331e124e65e73a5a02330fc97b3cdea902ad80390ed651b2fe389810584caa

  • memory/1628-54-0x0000000075831000-0x0000000075833000-memory.dmp

    Filesize

    8KB