Analysis
-
max time kernel
119s -
max time network
208s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:46
Static task
static1
Behavioral task
behavioral1
Sample
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe
Resource
win10v2004-20221111-en
General
-
Target
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe
-
Size
1.3MB
-
MD5
46dbda8c883bd7304287a4df4f901143
-
SHA1
9ac4c5f2146f75d1dc235c470b8efafa8faaba2f
-
SHA256
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0
-
SHA512
b1cd07a5184704956beb7b9aa2a1b70482d38568b66a37765cb0d546a03095b44f494cb550a0c9b704a1f06e9d8c4d0441dc36bfcf65adeabfaff86d6472ec2e
-
SSDEEP
24576:brKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakV:brKo4ZwCOnYjVmJPaW
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exedescription pid process target process PID 268 set thread context of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe -
Processes:
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exepid process 752 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 752 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 752 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 752 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 752 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exedescription pid process target process PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe PID 268 wrote to memory of 752 268 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe 3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe"C:\Users\Admin\AppData\Local\Temp\3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\3b3d63b72f47e9aff0947776d7d0492ea064067ceb59c447aeed41c1568947f0.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:752