Analysis
-
max time kernel
70s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:26
Static task
static1
Behavioral task
behavioral1
Sample
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe
Resource
win10v2004-20220812-en
General
-
Target
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe
-
Size
1.3MB
-
MD5
1c601460fc0a5ef7a5a1538fc64d410d
-
SHA1
3e9bcab3bb36ad9cec5f78c61103906f90922042
-
SHA256
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde
-
SHA512
ee551ece4e3db8408120638c1bc1b4aacb315829645be7bf9ff5c7f05acf34a2621ee916323790df850309cc0f65b1de3f4f447705f29a365a0d6dd3e44297f4
-
SSDEEP
24576:kKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcu:kKVzMNuwIKyoBmnMSURNQ
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exedescription pid process target process PID 896 set thread context of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe -
Processes:
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exepid process 964 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 964 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 964 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 964 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 964 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exedescription pid process target process PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe PID 896 wrote to memory of 964 896 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe 54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe"C:\Users\Admin\AppData\Local\Temp\54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54dcd65eea02d2a40e0e10cbb23a1c1d7ded2ca804c8f79dab432b0cfbaa4cde.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-54-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-55-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-57-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-59-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-61-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-63-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-65-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-66-0x000000000044D5E3-mapping.dmp
-
memory/964-68-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/964-69-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-70-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-71-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/964-72-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB