644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb

Analysis

max time kernel
27s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe
Size

1.3MB
MD5

e3d137d95edbd89ae3b169488b288ed8
SHA1

469cca76e562430410c148d9912e8035cddadffd
SHA256

644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb
SHA512

3ad39b2bf58cc92e6227b8a133d3f2699d323d1ccb826aff9d14db1dd33ef35d091d5653937557692aaf41d49aef3620624fb27f40449c15880a1bd81cb47b05
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak7:7rKo4ZwCOnYjVmJPaw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1264 set thread context of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1092	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe
1092	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe
1092	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe
1092	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe
1092	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28
PID 1264 wrote to memory of 1092	1264	644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe	28

C:\Users\Admin\AppData\Local\Temp\644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe
"C:\Users\Admin\AppData\Local\Temp\644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\644b4c5388f1ca22881f5073383f270b699db1e66ca0ee98feef49cdb67fa1eb.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-68-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download
memory/1092-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1092-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download