9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47

Analysis

max time kernel
171s
max time network
231s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe
Size

1.3MB
MD5

946d7e4ab988bd4ca92cade3711ca106
SHA1

09e9fe8ec007069812c169ae45abac38eaf403bb
SHA256

9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47
SHA512

0b48d35fe15554e4a7b3c36ebcdab6463a947fe64850f046ac7e36a6cff6843ef5fb0525b07fed969ec4d2b1866bd22318be109e7bb78629cd7e795e3141f53b
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakf:jrKo4ZwCOnYjVmJPaU

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1100 set thread context of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1264	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe
1264	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe
1264	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe
1264	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe
1264	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28
PID 1100 wrote to memory of 1264	1100	9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe	28

C:\Users\Admin\AppData\Local\Temp\9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe
"C:\Users\Admin\AppData\Local\Temp\9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\9cae806d67a000fa884c77b021688c5b8de241438f32bde9e746945598e19a47.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-68-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1264-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1264-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download