46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe
Size

1.3MB
MD5

83b9df0fbd64e200b66c5019985438a7
SHA1

83d1f3b2dd55a0da6074516bb4b1d278c8655fc9
SHA256

46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d
SHA512

19383956e16621b49c2bcb7a858d86a293a3951c4b942343bd1e564ee701f149bae6a583644942034ec4405951ac76021875161574bbd9a03b8001647f11b549
SSDEEP

24576:MpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBPU:TyFPu8D9k5QELuLc

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1788 set thread context of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
912	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe
912	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe
912	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe
912	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe
912	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27
PID 1788 wrote to memory of 912	1788	46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe	27

C:\Users\Admin\AppData\Local\Temp\46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe
"C:\Users\Admin\AppData\Local\Temp\46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\46dadbb5dcf515b9226c889470ac414dbef8b1d47c4f4ae14495bfdccf03de5d.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-68-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/912-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/912-71-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download