390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7

Analysis

max time kernel
22s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
Size

1.5MB
MD5

640298568751b1dc12a0d226856cc6d0
SHA1

bc22a9929288efcd73cdbe65c95103ae25fac415
SHA256

390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7
SHA512

d057f1c3e218f8caba6d0f8a839e22dc505ce861e669b2cd768846d4656181c68c9c7a8876d221c6660fa1f7748edecf527f52e8fcf28f0e607c85fbdfa5c6c4
SSDEEP

24576:S5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+J:YIBfvMkrNrf0u3qdaNLgQWiO+p

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
828	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
828	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
828	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
828	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
828	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28
PID 1716 wrote to memory of 828	1716	390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe	28

C:\Users\Admin\AppData\Local\Temp\390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
"C:\Users\Admin\AppData\Local\Temp\390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\390936879a9a7d2a85f2f842d2c8dcf6b87ef82a1bd8e50b95fbb35111ab1ae7.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-54-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-55-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-57-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-59-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-61-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-63-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-65-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-68-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/828-69-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-70-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/828-71-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download