Analysis
-
max time kernel
38s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:43
Static task
static1
Behavioral task
behavioral1
Sample
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe
Resource
win10v2004-20220812-en
General
-
Target
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe
-
Size
1.3MB
-
MD5
a51202bc50fa468f3ba50e82c520482b
-
SHA1
4af8192dcd2412140918e70abcd3e8a2134b46b2
-
SHA256
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25
-
SHA512
dc444408d0789a2b90c32cbc087efe6f667bc6527d6fcff4ed8520cc28f00eb0aebac0ea35dd6e7416978fbc16593eb4d0c440ec3c165764fef1ed1f512e1eee
-
SSDEEP
24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak4:7rKo4ZwCOnYjVmJPan
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exedescription pid process target process PID 1416 set thread context of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe -
Processes:
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exepid process 368 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 368 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 368 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 368 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 368 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exedescription pid process target process PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe PID 1416 wrote to memory of 368 1416 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe 3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe"C:\Users\Admin\AppData\Local\Temp\3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3d56d410651ab6803948eb4407a30285658654bcec96d0acebf9b5d4ef1abc25.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:368