Analysis
-
max time kernel
25s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 06:05
Static task
static1
Behavioral task
behavioral1
Sample
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe
Resource
win10v2004-20221111-en
General
-
Target
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe
-
Size
1.4MB
-
MD5
0f2f6acf875dfe1a5a17cf96ba5a9edb
-
SHA1
c78d749939da784441242d1f7bb4aed108c6edb7
-
SHA256
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b
-
SHA512
2396032f7db7fa7321a296d0be5235bd0bebbbe8ff5ed93b01700237d820a72f97809b099bb0f142d207870c52afd315f45a6089c4ad4bbe178dd33b9e2df38d
-
SSDEEP
24576:kKWQBT4nVU85afaniK/792DxAA4PNn0DLg78E2y2R3rh+Zx1kyFq:kNQJJ2B2WZd0DUGf3d+ZLkyk
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exedescription pid process target process PID 1628 set thread context of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe -
Processes:
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exepid process 1632 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 1632 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 1632 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 1632 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 1632 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exedescription pid process target process PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe PID 1628 wrote to memory of 1632 1628 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe 05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe"C:\Users\Admin\AppData\Local\Temp\05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\05eb56f1a91d5337f9130b52e2242c1b5d3dc5f28b7b8542000d55a709b0487b.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1632