98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe
Size

1.6MB
MD5

1e218a727933e7af88ee6cfbc8804a0d
SHA1

71b30ec9f0f2447baf7664db729b2bd6e0209ec6
SHA256

98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686
SHA512

24b7955d7380274ccab66d96a1679f46154522c901a8a275fb0b43a7d91038bcd58fa2d73e265bf5eb4d6dcf415ec74018129f59946596f169f86e5d5a5306a8
SSDEEP

24576:sFzJtFQQy+Yxa7kCleJkAKmP/0HWYs4LET3dJ6cTT10njVcyWjE8SDw/8rmxnZC/:oGQy1NvbduWE8S/mxZOebLE

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1672	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe
1672	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe
1672	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe
1672	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe
1672	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27
PID 1380 wrote to memory of 1672	1380	98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe	27

C:\Users\Admin\AppData\Local\Temp\98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe
"C:\Users\Admin\AppData\Local\Temp\98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe
  "C:\Users\Admin\AppData\Local\Temp\98ac820209ea2e0c01319b92f7001926d9c2030eb4060741db3af7d942665686.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-68-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1672-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1672-72-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download