Analysis

  • max time kernel
    134s
  • max time network
    208s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 09:12

General

  • Target

    e29a13cd79658489c09a3ed38a4870645c5a846046f9a41899b9ba5f6a54d352.exe

  • Size

    1.3MB

  • MD5

    d3940aa8449be1774b6a05622b721e02

  • SHA1

    e77aa14cfb3a0d70dcb588a68a8c2ad6398140ed

  • SHA256

    e29a13cd79658489c09a3ed38a4870645c5a846046f9a41899b9ba5f6a54d352

  • SHA512

    7d7fb8a79ade76843e268a4de2bf8ea751394116594430c6d2525a1891f2c36cc6c71f2bf4335accc8d2b4e1373490fc38835aa6e0ed3e516fa1c46f5f14bfca

  • SSDEEP

    24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakK:brKo4ZwCOnYjVmJPal

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e29a13cd79658489c09a3ed38a4870645c5a846046f9a41899b9ba5f6a54d352.exe
    "C:\Users\Admin\AppData\Local\Temp\e29a13cd79658489c09a3ed38a4870645c5a846046f9a41899b9ba5f6a54d352.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:888
    • C:\Users\Admin\AppData\Local\Temp\e29a13cd79658489c09a3ed38a4870645c5a846046f9a41899b9ba5f6a54d352.exe
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:752

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/752-54-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-55-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-57-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-59-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-61-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-63-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-65-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-66-0x000000000044E057-mapping.dmp

  • memory/752-68-0x00000000753F1000-0x00000000753F3000-memory.dmp

    Filesize

    8KB

  • memory/752-69-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-70-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/752-71-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB