f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe
Size

1.4MB
MD5

d31775707c73bc83d77a6a6c42d63825
SHA1

d8654ab3c33b331015f016d3e5b7850950ca9fb5
SHA256

f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f
SHA512

4a619c232c2a8c3efcd1df60b20f5879592d7dc30a3f19e163ac63f2dd882c39a59210d5a8731e47e336b21625d5169b9ba7729eb8a54d580e97e0e21f898e47
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Af:hrBew72604doSw6ewE

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
900	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe
900	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe
900	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe
900	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe
900	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27
PID 1956 wrote to memory of 900	1956	f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe	27

C:\Users\Admin\AppData\Local\Temp\f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe
"C:\Users\Admin\AppData\Local\Temp\f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\f33df99b0b0eacf73673a466a5ea4e01282ec6c602a9cc6785276934da9e5f0f.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-68-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/900-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/900-72-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download