9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98

Analysis

max time kernel
138s
max time network
137s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe
Size

1.3MB
MD5

be6afdd1e2c5172d0b5114fd7be044f9
SHA1

4797348db9f1abbdbf4de391e5a0726130ce0c83
SHA256

9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98
SHA512

6760805bee96c53b5765db12c4ec68df8f8695883f8b27877dd0392b766ba830defa7551e8daac507c0770569ba2c2b924ff994aa82807bc64d8d4cfde38d42e
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPaky:TrKo4ZwCOnYjVmJPad

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
868	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe
868	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe
868	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe
868	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe
868	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28
PID 1360 wrote to memory of 868	1360	9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe	28

C:\Users\Admin\AppData\Local\Temp\9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe
"C:\Users\Admin\AppData\Local\Temp\9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\9bbecf605ff0200eff041d715b0dd20ef01837f101127c4b7c5f888878394b98.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-68-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download
memory/868-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/868-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download