Analysis
-
max time kernel
53s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:18
Static task
static1
Behavioral task
behavioral1
Sample
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe
Resource
win10v2004-20221111-en
General
-
Target
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe
-
Size
1.2MB
-
MD5
28f602b82802655fe516e2023dfd2ed8
-
SHA1
e797db4f3058ba8e4d461dba1d16ead62f83e2ef
-
SHA256
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20
-
SHA512
1380dd83b4d0aa4531542a70916071b0e9124e4b6d72c44e38a708a66410f0a900f9b9291672e02943c95999ee4857ca1609434b138fd8248d8ffd9cd1e528fb
-
SSDEEP
12288:tSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfb5:sxw8wFDY3wE3wY6cxI6gWUbIwMLHf/M
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exedescription pid process target process PID 1596 set thread context of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe -
Processes:
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exepid process 1648 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe 1648 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe 1648 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe 1648 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe 1648 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exedescription pid process target process PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe PID 1596 wrote to memory of 1648 1596 deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe"C:\Users\Admin\AppData\Local\Temp\deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe"C:\Users\Admin\AppData\Local\Temp\deffefb69f5e3bd52964c272190d60eef32dcc6a71f02b33c51658e2e7942f20.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1648-54-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-55-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-57-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-59-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-61-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-63-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-65-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-66-0x0000000000452FFC-mapping.dmp
-
memory/1648-68-0x00000000757B1000-0x00000000757B3000-memory.dmpFilesize
8KB
-
memory/1648-69-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-70-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-71-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/1648-73-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB