Analysis
-
max time kernel
20s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 06:05
Static task
static1
Behavioral task
behavioral1
Sample
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe
Resource
win10v2004-20221111-en
General
-
Target
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe
-
Size
1.4MB
-
MD5
239f9acbdd23428e6d87f44b9a6bc113
-
SHA1
3aa5610e66d7d9f145dbd854f9db5c430a280d6d
-
SHA256
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d
-
SHA512
f920a64d5397229ce66f320a512bce359edac686c5df6aff51d28e244992dd14373429ae6148743deda393041c4c2baa5c4fc3c44e7b667c65e915d816bc3875
-
SSDEEP
24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ak:hrBew72604doSw6ewb
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exedescription pid process target process PID 936 set thread context of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe -
Processes:
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exepid process 1720 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 1720 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 1720 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 1720 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 1720 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exedescription pid process target process PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe PID 936 wrote to memory of 1720 936 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe 0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe"C:\Users\Admin\AppData\Local\Temp\0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\0581f4a31b4f4f6e8f53382eb3962d8a059e659931a3a070c3722a993611537d.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720