61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe
Size

1.4MB
MD5

9e9c0c51ab7b1635d8b9e21b2bec95bd
SHA1

fc0f04165c1da3df5d223cdd2d03f2774aa5df55
SHA256

61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb
SHA512

e6352dbc455bc22ab8524f5a67941f744d403b45fc4f60304955493f2e857cd26316bf7b399a9e5a78d9de49e962cf04d48412a9cc077c92c90fd718fab5eb43
SSDEEP

24576:hrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8Ae:hrBew72604doSw6ew1

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1972	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe
1972	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe
1972	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe
1972	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe
1972	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28
PID 1980 wrote to memory of 1972	1980	61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe	28

C:\Users\Admin\AppData\Local\Temp\61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe
"C:\Users\Admin\AppData\Local\Temp\61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\61d7c70601f5f2cda4b866a091736849ab26d3a50eb6364fd2ca35c6015943fb.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-68-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1972-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1972-72-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download