e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd

Analysis

max time kernel
25s
max time network
39s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe
Size

1.0MB
MD5

4e585b56026bd6b4e60836889cc71e57
SHA1

e2731e78be851626a39997b77d45c3ed314f8ba2
SHA256

e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd
SHA512

d8102ae32ba15fe4584b366b7b1a39acdaa10e4900b67d0a6b3dc28f21edfd9a729f256bc6517ca4270883678aafdda24e0b67f72d7997b5a740fdbc76106609
SSDEEP

24576:/J0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlps:/WFPaXGalaCTt8XjwoGji8r

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1748 set thread context of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1668	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe
1668	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe
1668	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe
1668	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe
1668	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28
PID 1748 wrote to memory of 1668	1748	e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe	28

C:\Users\Admin\AppData\Local\Temp\e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe
"C:\Users\Admin\AppData\Local\Temp\e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\e706519fab6b412e55f12d45b0c5e56b4a48b76b11addfcc3988ba7212dcd8bd.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-68-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1668-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1668-71-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download