9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80

Analysis

max time kernel
71s
max time network
92s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe
Size

1.2MB
MD5

3a34f943d253941ccaa4f6981bda6f83
SHA1

1ab13e77c6a07ac95cc31e2db6c95f4ea9a4ce60
SHA256

9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80
SHA512

07d35249d4a5dc6e814df31b69b34ec76378404cbdbd1ebf0d305f883d65fc6979bc7ac6c95b5a76f0fe8da2dc1557c44008d7b4128e499bb35c46b0d336d2a4
SSDEEP

24576:SGD1/ZXsoT57jWpD5PmAavQOiAA+BBSw3j3gEIBCqZShfVDZ/8w:SI1Bsot/WaAbOiYd3gEXBpVdf

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1368	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe
1368	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe
1368	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe
1368	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe
1368	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28
PID 1336 wrote to memory of 1368	1336	9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe	28

C:\Users\Admin\AppData\Local\Temp\9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe
"C:\Users\Admin\AppData\Local\Temp\9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\9183da78139b7fc1f46c45d01e96d753f2d6d352accbe194076f0b551dd5ab80.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-55-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-57-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-59-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-61-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-63-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-65-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-68-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1368-69-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-70-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-71-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/1368-72-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download