84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6

Analysis

max time kernel
149s
max time network
170s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe
Size

1.3MB
MD5

213c37a612b8cfa0264d3236df13fac6
SHA1

e6014fd69f46a87a55fbaa863420a6e4a492bc1c
SHA256

84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6
SHA512

4702f7cecc92648ea5de5f4a2b011650d74fa326736d3b1d507abde4ebb80da0b7e24c3615e3fc17406718152a96f7b4eabcd46b11c71f97b171e5bd2fdee784
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:zrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1972	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe
1972	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe
1972	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe
1972	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe
1972	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28
PID 2012 wrote to memory of 1972	2012	84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe	28

C:\Users\Admin\AppData\Local\Temp\84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe
"C:\Users\Admin\AppData\Local\Temp\84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\84c7335c85f0b1e5db658505fb2e18355e5bbbc4be2bef31ecc6bde8faaccde6.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-68-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/1972-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1972-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download