21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe
Size

1.3MB
MD5

1ff09210aa8387b2ddf8015322e95965
SHA1

773b857c4c2cc57db0a0c5002fa7cf93439af61b
SHA256

21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26
SHA512

9123df4e5841cb701ca5a2be685396457660f4672585bcc1afc1f9e3bfef262cf096e1fe55c5e103e21720d3a5134bdc450dd1859b98d927d2672ec89f7b444b
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak:rrKo4ZwCOnYjVmJPa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1792	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe
1792	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe
1792	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe
1792	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe
1792	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28
PID 1260 wrote to memory of 1792	1260	21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe	28

C:\Users\Admin\AppData\Local\Temp\21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe
"C:\Users\Admin\AppData\Local\Temp\21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\21c5486a056eef010829b715de4a36658e677ea92271bb7bac5b86e519a51b26.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-68-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/1792-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1792-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download