c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a

Analysis

max time kernel
14s
max time network
36s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe
Size

1.3MB
MD5

16c30c8fce65443620f8c3a7357009cc
SHA1

5027925b85492cd8b880a72cbbbc293ea9fe9ac0
SHA256

c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a
SHA512

7c5db787ff7cbc1430bbada82c55d25cc97fd09176e37a627c9695c01d329f1765836370a4e3b9bf7b90ca6ebeb2491bd89d023afd4f749ae18c97cd9af6c67d
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakf:zrKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1676	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe
1676	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe
1676	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe
1676	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe
1676	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28
PID 1244 wrote to memory of 1676	1244	c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe	28

C:\Users\Admin\AppData\Local\Temp\c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe
"C:\Users\Admin\AppData\Local\Temp\c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\c20dd73d81bd826dd612e6b94e692f27b3bd80ffdc6e374678eab07de7f0bc5a.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-68-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1676-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1676-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download