Analysis
-
max time kernel
15s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 21:48
Static task
static1
Behavioral task
behavioral1
Sample
804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe
Resource
win10v2004-20220812-en
General
-
Target
804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe
-
Size
1.4MB
-
MD5
8421548384fe4eac65334362fbe7d9ba
-
SHA1
d2f2ac6f046798f24ba330796a0606f02360c6f2
-
SHA256
804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138
-
SHA512
c4504f9ecc1135a2c638390b6d3d55ac6af9e7c12901b18a50a8d42486266d2ef098bd029a0b5201658c314311a08755fbee4d2c13d56c86538027bfb360fc05
-
SSDEEP
24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AM:BrBew72604doSw6ew/
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1532 set thread context of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1544 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 1544 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 1544 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 1544 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 1544 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28 PID 1532 wrote to memory of 1544 1532 804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe"C:\Users\Admin\AppData\Local\Temp\804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\804efc95e42d423dfe2b31327c070bd0be8bf2e750f26da61d1c96c736cc4138.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1544
-