baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217

General

Target

baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
Size

1.1MB
MD5

38173691d38c65adbf2aec5a3a84f4d3
SHA1

d51882691267f38377f78dae8e2f27b6bb87350c
SHA256

baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217
SHA512

b89155effd4fe82ef229695853b277d92687713679f9efa95d91e32d647b0b935ecf9d8281d28b49f1f3c0836291cc91c154c32363986e2cedc58149b34011d1
SSDEEP

24576:zjmOztIjpVbUJ44R/DDK2s5mNZRzOUCrA/N3rn:zqAtI704g/D3Tm03L

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

description	pid	process	target process
PID 608 set thread context of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

pid	process
804	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
804	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
804	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
804	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
804	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

description	pid	process	target process
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
PID 608 wrote to memory of 804	608	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe	baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe

C:\Users\Admin\AppData\Local\Temp\baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
"C:\Users\Admin\AppData\Local\Temp\baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:608

C:\Users\Admin\AppData\Local\Temp\baaf2f89a84e295f11f92f3fbd73f57ad6c6bb14422a631def382af94fd47217.exe
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-54-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-55-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-57-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-59-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-61-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-63-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-65-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-66-0x000000000044E28C-mapping.dmp

Download
memory/804-68-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/804-69-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-70-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/804-71-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads