6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe
Size

1.2MB
MD5

80d866268b03b23c17df78a479da8452
SHA1

a4d5da8dec8214937a3769bc3b9decc6ae94cd5f
SHA256

6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14
SHA512

fccad8c2c3bd342fee3ab7511d9d552b629bd63ea3796530beede19a053cefc93015df701bb2c503862db879b0600586778a06230560340c8c41cb86947c5f00
SSDEEP

24576:JXIe1k135jsYx0ySMIAA/9I+8jhIFqpmMcZIKxKfr:JXfyFBIAupqpm1asm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1172	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe
1172	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe
1172	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe
1172	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe
1172	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26
PID 1584 wrote to memory of 1172	1584	6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe	26

C:\Users\Admin\AppData\Local\Temp\6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe
"C:\Users\Admin\AppData\Local\Temp\6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\6f1ed5778b587ef01c69da7673a5bc0147b1263ffe589388ca3f0081d7ad2d14.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-68-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1172-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-71-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1172-73-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download