ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634

Analysis

max time kernel
46s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe
Size

1.1MB
MD5

c91e0eb8867a5706cf7884918eb58b1a
SHA1

0d0898cadf02819a0214f727608420a3f1bb2f8e
SHA256

ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634
SHA512

d15bba3d1b4efd3006b923282a37541d119313e2f1bdebd6ef8353dade2d58fdf31331e1d6d3a9cb86bdf6cc176f03237730b3c9b78599e63bdf60d6a155873e
SSDEEP

24576:SF/QS8oTXrxf4XQjfxYE3ncjq5E8TIc4+nDCgS:SNHTtf4XkQq5E8gQ2T

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
628	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe
628	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe
628	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe
628	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe
628	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27
PID 960 wrote to memory of 628	960	ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe	27

C:\Users\Admin\AppData\Local\Temp\ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe
"C:\Users\Admin\AppData\Local\Temp\ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\ae2147e734db713f9a8cb0025dd83a58c15382792de5895fc1b3179f221d0634.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-54-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-55-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-57-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-59-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-61-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-63-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-65-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-68-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/628-69-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-70-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/628-71-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download