3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af

Analysis

max time kernel
21s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe
Size

1.3MB
MD5

c72c28b40849e1964a46ba76bf9775ba
SHA1

084bcb2792fec6b32b1cde53021c75d2526ba105
SHA256

3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af
SHA512

98bc4440bb243f56c4a19c0e0a68a69982de07fd04fdc268b1b3d3c8ba23afd5d2418640ab09063d54a0fba7ea46474816c13237838beb2e97f4a48a39924b6b
SSDEEP

24576:qXO93poEu4pCkao1bNQfSyNGXTYGwwKCWiBe+I351KDsTXY8vZ6Qeh:qMZoANNbyNGjW8u5MsTXY8vfg

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2040	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe
2040	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe
2040	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe
2040	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe
2040	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27
PID 2012 wrote to memory of 2040	2012	3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe	27

C:\Users\Admin\AppData\Local\Temp\3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe
"C:\Users\Admin\AppData\Local\Temp\3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\3bd95f95ffb681f11e275b6d07c0cc4ae8f57a5fe91d6a6b0d085428f31460af.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-68-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/2040-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2040-72-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download