ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1

Analysis

max time kernel
166s
max time network
194s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
Size

1.3MB
MD5

ab795080cd1b22d056a4dae3cd2240d6
SHA1

e5374f8ae092e969298903e4a0e8578ada5b4412
SHA256

ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1
SHA512

47dcc44762c326ae9b0e518e89b9505bd401390069a9b11cf1b9248b21ac8939362ed13a8e4b2f1339ac0a9cdbc43174242e55c6720222ab63e9b29e0cdb76db
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakP:7rKo4ZwCOnYjVmJPaI

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1772 set thread context of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
964	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
964	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
964	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
964	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
964	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28
PID 1772 wrote to memory of 964	1772	ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe	28

C:\Users\Admin\AppData\Local\Temp\ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
"C:\Users\Admin\AppData\Local\Temp\ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\ab31b4c8058aec9d76a8777d26a77abd5d9b9a39295cc9f0fac88740d3f090f1.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-68-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/964-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/964-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download