abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2.exe
Size

28KB
MD5

138d83026aa9a49afa2ae8f7c35839e3
SHA1

6b53900e1fe5a1cc2b108b10956e6e5f5d7fd3a3
SHA256

abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2
SHA512

4099e60cef53cd81a893d12ec60d9400943a6986efd1112d19d816a61893136d6361992ef53d436037956ebb64d5cb77c186c6ed254860a239e64620e704f786
SSDEEP

192:+Wq32GB+1tLzIznWd7+PjbEAEwlwEEwpTAGr4UtExq32:Xg22nWMOchr4jxg2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1640	abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2.exe
1640	abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2.exe
1640	abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2.exe

C:\Users\Admin\AppData\Local\Temp\abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2.exe
"C:\Users\Admin\AppData\Local\Temp\abc4967247f3a57f0a53be5db4942165b8c44ea0fa90959723e3fe7c83aa17b2.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-56-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1640-57-0x0000000004341000-0x00000000051ED000-memory.dmp

Filesize
14.7MB

Download