4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe
Size

1.4MB
MD5

1ddd37029e6b41631fc50bab11789a87
SHA1

2b4ed2627d0ca0d16e78cd138545892042f8276c
SHA256

4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad
SHA512

ed35c6197e4a90862caa37be3a710f1a7533412d9a7555a913b1e80fc668b06b7f22acc4f1da5ca1696800944161f036a1d7c2a7da9e92b894ac498633ca6bcf
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AX:hrBew72604doSw6ewo

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1044	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe
1044	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe
1044	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe
1044	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe
1044	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27
PID 1688 wrote to memory of 1044	1688	4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe	27

C:\Users\Admin\AppData\Local\Temp\4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe
"C:\Users\Admin\AppData\Local\Temp\4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\4cfddf0daf7a4b2cef22d797c3370d66cacaefacd55da5bc58bf9ff419659bad.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-68-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1044-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-72-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1044-73-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download