Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:00
Static task
static1
Behavioral task
behavioral1
Sample
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe
Resource
win10v2004-20220812-en
General
-
Target
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe
-
Size
1.6MB
-
MD5
5dd9d52cd086eca930578e0919d81c19
-
SHA1
53553b117dfddd92e324ed5ffc01e41f0d0c7765
-
SHA256
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd
-
SHA512
e37aa6e90aab814b9bdd87c8369a68cbc71da3a78854b12f312eafeb8e0ca41c19a77c5ae8c3efb5cb7559015392eede446c544c01e9b2061bf5d65507bc3d75
-
SSDEEP
24576:RzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYS:j6/ye0PIphrp9Zuvjqa0UidF
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exedescription pid process target process PID 1392 set thread context of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe -
Processes:
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exepid process 692 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe 692 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe 692 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe 692 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe 692 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exedescription pid process target process PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe PID 1392 wrote to memory of 692 1392 c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe"C:\Users\Admin\AppData\Local\Temp\c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe"C:\Users\Admin\AppData\Local\Temp\c46e7fa7bc41cee8e71af01d5179a7b537888f24d581b93b62540824db5525cd.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/692-54-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-55-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-57-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-59-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-61-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-63-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-65-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-66-0x000000000045304C-mapping.dmp
-
memory/692-68-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/692-69-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-70-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-71-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/692-72-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB