bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5

Analysis

max time kernel
177s
max time network
189s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe
Size

1.3MB
MD5

8c8d62b447b33be72e17b11f6524235c
SHA1

a81cefa7a505f39f0aaea1a27bf084451d36def5
SHA256

bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5
SHA512

850822fbe5888298a7d671d56eeb45e75e1f0fb6833ca1e6cdcf0d6b070a2470bcb49883621332554795d05b0d3dc26a9a72b42ca3e4431cd0086cd11967cfb8
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakS:7rKo4ZwCOnYjVmJPaF

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1680	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe
1680	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe
1680	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe
1680	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe
1680	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28
PID 1232 wrote to memory of 1680	1232	bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe	28

C:\Users\Admin\AppData\Local\Temp\bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe
"C:\Users\Admin\AppData\Local\Temp\bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\bafc03a6f6da807c792f1ebf64e24f7516ef7cffb20b2cf489997df8f3812ec5.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-68-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1680-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1680-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download