Analysis
-
max time kernel
44s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:38
Static task
static1
Behavioral task
behavioral1
Sample
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe
Resource
win10v2004-20221111-en
General
-
Target
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe
-
Size
1.3MB
-
MD5
cce21c4780dec1b9b76a47e16556ecfe
-
SHA1
a004e575364b21797f00b2b6f3d7155d221ea754
-
SHA256
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90
-
SHA512
38b9d5671497cd9aeea060e526873ec055ed647b4d2df021b138d07cb16e9867353fc1800970304b55aa66c63afa39368982f87126b7a43c329e89d73d20b434
-
SSDEEP
24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakP:TrKo4ZwCOnYjVmJPa0
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exedescription pid process target process PID 1440 set thread context of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe -
Processes:
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exepid process 1308 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe 1308 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe 1308 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe 1308 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe 1308 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exedescription pid process target process PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe PID 1440 wrote to memory of 1308 1440 ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe"C:\Users\Admin\AppData\Local\Temp\ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\ad1e4e7024406db0125c3f48831d270fec0fa27cf33824cd3e02101e64987d90.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1308