e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4

Analysis

max time kernel
69s
max time network
88s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe
Size

1.4MB
MD5

ed8a3cb5c67fe68aedbda8364db9e12c
SHA1

86fab6f031a752121df18ba82bf657c1d343c9ec
SHA256

e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4
SHA512

21c61a79b8f122e1f93598e8317f1a80e23816c6650620b4c4732fbda0dd6a1de8adb71fa732d632415e0570533ba9b2f0706f16ab7b8307a427114607eda82d
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8AX:hrBew72604doSw6ewE

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1056 set thread context of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
288	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe
288	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe
288	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe
288	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe
288	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28
PID 1056 wrote to memory of 288	1056	e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe	28

C:\Users\Admin\AppData\Local\Temp\e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe
"C:\Users\Admin\AppData\Local\Temp\e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\e4c7963400088768d4d81ee7f4d95f84f0f7bb544228df34830660eb7c6830a4.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-68-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/288-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-71-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/288-72-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download