60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 11:57 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe
Size

1.3MB
MD5

0afcc6ea1c0fca96202b6a2d5dd48c02
SHA1

318f355bae4e46f89238119b3deb5c7045413a37
SHA256

60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d
SHA512

a43688cdf0ce30f452dd1b5b45101e1d92392f5c57ed94506ff73335589072f374b4d7a21dea6c080101c94c2ec248592c532272e18d3bb5b44dc44b84b4008d
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakw:zrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1076	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe
1076	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe
1076	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe
1076	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe
1076	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27
PID 1760 wrote to memory of 1076	1760	60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe	27

C:\Users\Admin\AppData\Local\Temp\60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe
"C:\Users\Admin\AppData\Local\Temp\60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1076

Network

DNS

0iufbl8hlj0rta4spa.5vk5dzpui3.com

60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe

Remote address:

8.8.8.8:53

Request

0iufbl8hlj0rta4spa.5vk5dzpui3.com

IN A

Response

No results found

8.8.8.8:53

0iufbl8hlj0rta4spa.5vk5dzpui3.com

dns

60e339fa71c02ae78bf652903346c02353d14cbbfcb250e9111b5d7c676a240d.exe

79 B
152 B
1
1

DNS Request

0iufbl8hlj0rta4spa.5vk5dzpui3.com

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-68-0x0000000075F31000-0x0000000075F33000-memory.dmp

Filesize
8KB

Download
memory/1076-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1076-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download