a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944

Analysis

max time kernel
115s
max time network
118s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe
Size

1.3MB
MD5

646960f0a14965bcfcd5e84047e443b1
SHA1

35e3c3ca2abe53747e3eeb9a8e1b5214fda5a0e9
SHA256

a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944
SHA512

446c4d2afc25b91e322ef80cbb11894d4042c4612decb9f82f556fe840a941e1774ca8556b5c8ba4c405c466025f316ecd1e047b0c0ea3240fc4fe9cc38e12e2
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPako:zrKo4ZwCOnYjVmJPaX

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1932	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe
1932	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe
1932	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe
1932	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe
1932	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28
PID 1896 wrote to memory of 1932	1896	a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe	28

C:\Users\Admin\AppData\Local\Temp\a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe
"C:\Users\Admin\AppData\Local\Temp\a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\a9ebfbd331c461ea716b1feed07d10e62797c0a8c0abe148492bd0c30adc3944.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-68-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1932-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1932-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download