353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c

General

Target

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
Size

1.3MB
MD5

921ddaecbfe34d325da626b079b2625a
SHA1

ff88da32565d58fbf0497077a0baf62677c21834
SHA256

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c
SHA512

5a6662661a14669296cbacac95fe7db328d73de7b7db39526ff74a091886f2722db89cfb690ebdf5cb1bff73c91cbb13f895b3e8443f3362ae1057a2da7a8234
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakt:zrKo4ZwCOnYjVmJPaS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

description	pid	process	target process
PID 524 set thread context of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

pid	process
584	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
584	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
584	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
584	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
584	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

description	pid	process	target process
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
PID 524 wrote to memory of 584	524	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe	353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe

C:\Users\Admin\AppData\Local\Temp\353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
"C:\Users\Admin\AppData\Local\Temp\353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:524
- C:\Users\Admin\AppData\Local\Temp\353dae90c80f36d9e48d471163cc45012323c477a8302d2dfb80c3930926688c.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-66-0x000000000044E057-mapping.dmp

Download
memory/584-68-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/584-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/584-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads