d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5

Analysis

max time kernel
20s
max time network
39s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
Size

1.0MB
MD5

4167e275c9bfcc10905fa781540ecc1a
SHA1

b46cffb52ba996f8928f616defc573ecd6580d0f
SHA256

d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5
SHA512

b27577ab560a16b8205228f6be6cd44508cb86a90a7e368fe22a14221c40be38097fc9257224d8de03478627e22b5fb003e902b37bea7285455f435888210254
SSDEEP

24576:oJ0FPl0XoDnqgEdhlaCT3xXGHRXjEuuMjM4jm6dVriAUli8WXHXlpq:oWFPaXGalaCTt8XjwoGji8B

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
960	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
960	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
960	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
960	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
960	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28
PID 1364 wrote to memory of 960	1364	d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe	28

C:\Users\Admin\AppData\Local\Temp\d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
"C:\Users\Admin\AppData\Local\Temp\d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\d38e8464d3f31cf57d97f021353752eb908776c602cd6826fa2a3fc3cbb068c5.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-68-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download
memory/960-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/960-72-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download