Analysis
-
max time kernel
45s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:28
Static task
static1
Behavioral task
behavioral1
Sample
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe
Resource
win10v2004-20220812-en
General
-
Target
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe
-
Size
1.3MB
-
MD5
30e0de518f41e330465fd0f208c287e3
-
SHA1
7615f62cc9ff0315322c6aa3bd94d2441f842bd6
-
SHA256
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481
-
SHA512
963ba1812b8029e50c086548099386f63037fb6df08c7efc3095d0b8e32c6c79880557452d8f7c937e7ac5c75d68108ae7d6226919630eadf4d4ecf8189d80a2
-
SSDEEP
24576:2KyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcug:2KVzMNuwIKyoBmnMSURNQA
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exedescription pid process target process PID 1600 set thread context of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe -
Processes:
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exepid process 1260 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 1260 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 1260 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 1260 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 1260 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exedescription pid process target process PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe PID 1600 wrote to memory of 1260 1600 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe 2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe"C:\Users\Admin\AppData\Local\Temp\2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2051c44494cfaae4de5a5fd1a79614cd5edd30fcb7374420e81f4402bc0c2481.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1260-54-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-55-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-57-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-59-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-61-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-63-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-65-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-66-0x000000000044D5E3-mapping.dmp
-
memory/1260-68-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1260-69-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-70-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1260-72-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB