6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 11:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
Size

1.3MB
MD5

7dc8051b7303c0ab2c87b834bbaa21da
SHA1

7d461413b3f6f2f81393b275a6c27a314124e12a
SHA256

6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d
SHA512

605e7d3a08fd5c116e4458d9420cdb1ae1d1ff826dad18a8adcbbe2290b15f100868114172073279ebc05d7ea5ae49f8fb11ba7f6bad8c441c9a212623c0dfa4
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak3:zrKo4ZwCOnYjVmJPaM

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
112	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
112	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
112	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
112	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
112	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28
PID 1676 wrote to memory of 112	1676	6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe	28

C:\Users\Admin\AppData\Local\Temp\6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
"C:\Users\Admin\AppData\Local\Temp\6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\6fe8608afc60cfcdb7b79e255f9ca0677591e4a32aa28e58b497656298ab0f9d.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-68-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/112-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/112-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download