3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf

Analysis

max time kernel
31s
max time network
46s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe
Size

1.3MB
MD5

38f128051b54c2a7449d8f988e6ed935
SHA1

0ceb7899ab4b134122155ec2ce21f0a071cdd09c
SHA256

3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf
SHA512

fb5129de42c3fd3fa3aeed451f4029f62260d98f844061e8d5dfbcb7ec7823fbd21df5480ea33501ee035373506e25ab4802d6cbbe6cc4a8683c904c2e4737c8
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakU:jrKo4ZwCOnYjVmJPa7

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1364	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe
1364	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe
1364	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe
1364	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe
1364	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28
PID 1228 wrote to memory of 1364	1228	3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe	28

C:\Users\Admin\AppData\Local\Temp\3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe
"C:\Users\Admin\AppData\Local\Temp\3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\3c623853f381da4ef17cc03180d58ef7c25dcd24989b8e5d1e92927c3d3f1faf.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-68-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1364-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1364-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download