3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785

Analysis

max time kernel
49s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe
Size

1.4MB
MD5

0321535ed6db0d47464855938306b617
SHA1

1d364a8d98469c024c87fdff4cf3fe6a0e39ba8a
SHA256

3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785
SHA512

2a0391fdc2081ed03b1629df279f143d552e6db2d089add1c11d3d92523b2cce6d638139bbd326c9184650a63dc2540486173987360700e0c9315390e8c2c6f2
SSDEEP

24576:RrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AG:RrBew72604doSw6ewd

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1480	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe
1480	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe
1480	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe
1480	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe
1480	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27
PID 1448 wrote to memory of 1480	1448	3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe	27

C:\Users\Admin\AppData\Local\Temp\3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe
"C:\Users\Admin\AppData\Local\Temp\3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\3b8512ace05ba2e5ed21dbc02cb0bd6dc037b6eed75389a86dc443c8e9dbf785.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-68-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1480-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-71-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1480-73-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download