3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe
Size

1.2MB
MD5

836e14af29727bb03f504324dc62a64a
SHA1

aca855b00d7b04ab56f73d9d46b21b164c34c7e3
SHA256

3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e
SHA512

d1b9b6217ebfb8470daeed721501aa71943830433dc7c04e6789d2bbe659ee649af86c4f608203b3b69f2bdf988062f3739e0e6a7d4b5c7a0a258982d1759677
SSDEEP

24576:J8Ax9GLS59Q2SQUVqyeFtBJepApojDkfW/1RJMGdmXT:h955i2S5VFIBJewerJMkmj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1160	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe
1160	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe
1160	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe
1160	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe
1160	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27
PID 1976 wrote to memory of 1160	1976	3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe	27

C:\Users\Admin\AppData\Local\Temp\3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe
"C:\Users\Admin\AppData\Local\Temp\3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\3edb9347fb2584a1fd1a38b6e432442d3f1a620568194c4653abd8a87d0d569e.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-54-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-55-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-57-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-59-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-61-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-63-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-65-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-68-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1160-69-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-70-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1160-72-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download