e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748

Analysis

max time kernel
43s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe
Size

1.3MB
MD5

304b385e23eafae96cea42f17f74a97b
SHA1

42e77970615ba66ca8b74b44b21a7c062ba41227
SHA256

e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748
SHA512

3910acd4ac77169a0f6063afc52cba7c0700a247a16bad2f2636ff4669ccb751b6e34a9684e7b9bd6eac1fa3f2e99ec4ac3ab60534fa954b9cbf628d5f80b83a
SSDEEP

24576:LGjJZtAXaMb5YpCCNAfGU64giomYhXlZwVBhVS+JbIHICWKotTn+n:LGNZpbmfLRgioDXz+BhA3SvVnq

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 288 set thread context of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
748	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe
748	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe
748	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe
748	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe
748	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28
PID 288 wrote to memory of 748	288	e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe	28

C:\Users\Admin\AppData\Local\Temp\e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe
"C:\Users\Admin\AppData\Local\Temp\e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:288
- C:\Users\Admin\AppData\Local\Temp\e5d6b1856e585bd9f5a94ba3cc08e9b145c75d4dceed7f065fe75ff47516a748.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-68-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/748-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/748-72-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download