15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe
Size

84KB
MD5

0e55e35e668e9c8d0879df7f382ab830
SHA1

11c235b5455d3cdcfcfdd22bd3852678d094078d
SHA256

15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307
SHA512

a812b1d9920ca167267d9c38820d7138b3490e5c5f064e61217b45c1d8c1bde5f3c2a06275d4aff64ab74c5e3fcb371fa448c73f655985d512251ae47df2c41e
SSDEEP

768:e3ncJu5hBXF2pmiq2V41xNmAFgGyi4XwP13GT9W28z/zMp5xAFiE3s:e3cJu5hBVWq2kN6LXwPVGT9lgA5gs

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	1280	WerFault.exe	9

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Internet Explorer\Main	15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe
1700	15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1280	1700	15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe	9

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1280
- C:\Users\Admin\AppData\Local\Temp\15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe
  "C:\Users\Admin\AppData\Local\Temp\15ca5b0deae9bb670987e677331bf50ee67a6d8e8f49bd6a47629fe13ae48307.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1280 -s 1800
  2⤵
  - Program crash
  PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download