c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333

General

Target

c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
Size

1.3MB
MD5

28fdf0ec867999fc11929636124206e9
SHA1

b2fd39322730aa1e5913ceda9076e76b910bfbb3
SHA256

c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333
SHA512

49213610f8308e6fc8ddac8d9b7d434546043d06a8b6f8879eed968134ea3fa50f2d9b60b9c47751d47c8ec911608ce24963412f5c844314f5e13105abbd17f3
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak+:zrKo4ZwCOnYjVmJPaF

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

description	pid	process	target process
PID 1148 set thread context of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

pid	process
1984	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
1984	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
1984	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
1984	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
1984	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

description	pid	process	target process
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
PID 1148 wrote to memory of 1984	1148	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe	c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe

C:\Users\Admin\AppData\Local\Temp\c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
"C:\Users\Admin\AppData\Local\Temp\c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Local\Temp\c2af8b6bd3ee34e77482cba2c728a69185f46fa76405b585d23b77a13cf54333.exe
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-66-0x000000000044E057-mapping.dmp

Download
memory/1984-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-68-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1984-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1984-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads