019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
Size

1.4MB
MD5

b53905a652d721eddee38716bc2b773b
SHA1

f61315b91de6111812d552e048c99f30ff0123cb
SHA256

019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a
SHA512

239ecf78c82c4fa1454dff14abc72a7d62f5ef8dce6643a96d4ad27e6f6cbae2ed5c0aa110e4741c3618350b9fb597eda61d1de15943ba65b76b8fbc5f8b3d94
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Aj:BrBew72604doSw6ewI

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1272 set thread context of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1332	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
1332	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
1332	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
1332	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
1332	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27
PID 1272 wrote to memory of 1332	1272	019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe	27

C:\Users\Admin\AppData\Local\Temp\019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
"C:\Users\Admin\AppData\Local\Temp\019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\019a39933334cfb07f21eb58488c88f7c54e51d4195ea9127e21e2082c988d0a.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-66-0x000000000044937A-mapping.dmp

Download
memory/1332-68-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1332-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1332-71-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download