Analysis
-
max time kernel
41s -
max time network
88s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:45
Static task
static1
Behavioral task
behavioral1
Sample
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe
Resource
win10v2004-20221111-en
General
-
Target
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe
-
Size
1.3MB
-
MD5
dd9844c085556afbf6bba42a72d42668
-
SHA1
65a8c75c3e54c43f269a562e7798d2ee08ba2a7c
-
SHA256
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a
-
SHA512
f440e8b754b68fb7826ecc11b59dba45704c285ae979d47693c09cbd7c02fcc17db00cf2a45a743c5c80d0ac00ac8978bc842e7ee8525976d9e51bd23b1b8d64
-
SSDEEP
24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakX:7rKo4ZwCOnYjVmJPaQ
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exedescription pid process target process PID 1724 set thread context of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe -
Processes:
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exepid process 528 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 528 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 528 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 528 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 528 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exedescription pid process target process PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe PID 1724 wrote to memory of 528 1724 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe 3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe"C:\Users\Admin\AppData\Local\Temp\3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3c3a1c739fcb30677cac4489a6d70828294f1bcca2240582eb8d118318f9423a.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:528