bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668

Analysis

max time kernel
133s
max time network
138s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe
Size

1.3MB
MD5

29c08746865d9f590e24dc8c11a67bb0
SHA1

c3f9d09c6cdff90dbf90d1bff9dc264897dedafa
SHA256

bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668
SHA512

e5fd0f128fef63a79c18ea8287ab84ec99eee1eb0e7093ba5ab48162c41ce9d5b4e2c49624c1ba443c1afb2808a344fd97376ba8d8e83e2c668dddff1b25d578
SSDEEP

24576:JDASdSysJOcj0VQpWbl7s2LP0CXuiAayiWASALUgv2j6R6XEVeRs9HgVfgJx:OSQtk2zQytkgis6yxkx

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1376	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe
1376	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe
1376	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe
1376	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe
1376	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28
PID 1496 wrote to memory of 1376	1496	bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe	28

C:\Users\Admin\AppData\Local\Temp\bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe
"C:\Users\Admin\AppData\Local\Temp\bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\bef04a8a0aae6c3ba9b86f67b8cf084d92daff04ae2ac77005fc5aeb282aa668.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-68-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1376-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-71-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1376-73-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download