69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8

Analysis

max time kernel
47s
max time network
85s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe
Size

1.3MB
MD5

f425c383574ee7fcc714b63ab95e0ffd
SHA1

1a9490794524e602690aa0843751be0231c5237d
SHA256

69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8
SHA512

a28ea98ff2fe45946863d315b223fa81fb8c039d359847fa47a0f7b5bb12543975bbabc2aa8b812d863ec7255c3f37b891b702ad30edf417eb78eb72b93b5479
SSDEEP

24576:FpyhP5RFFrSEyFPu8JR9ksaQFCLwbLflBP0:CyFPu8D9k5QELuL8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1216	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe
1216	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe
1216	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe
1216	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe
1216	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28
PID 1724 wrote to memory of 1216	1724	69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe	28

C:\Users\Admin\AppData\Local\Temp\69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe
"C:\Users\Admin\AppData\Local\Temp\69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\69db85d05b2f7b81be60c2b9385b67a5d60ce07244f928b39b9af054c37a2cc8.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-68-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/1216-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-71-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1216-73-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download