8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe
Size

1.4MB
MD5

70a266c26759789fb61b2dddbc6acdb8
SHA1

fe4b07b7ad80bd3b4e1368f07cb029b891a8a6ee
SHA256

8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9
SHA512

d7f6ce409cc89094d5bff9c9b92a404d291bfe04269c66cd41804f75355e75f720d6b1a0601f37c4b0bf1ccdd912dddac692ec1cd8807328b42c8dabe00096c5
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8A/:BrBew72604doSw6ewA

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
928	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe
928	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe
928	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe
928	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe
928	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27
PID 992 wrote to memory of 928	992	8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe	27

C:\Users\Admin\AppData\Local\Temp\8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe
"C:\Users\Admin\AppData\Local\Temp\8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\8d069e3cd8161633993fc2c403aeaf91e1df85c8f5ac653875ca65bc8abb21f9.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-68-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/928-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/928-71-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download