abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c

Analysis

max time kernel
20s
max time network
64s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe
Size

961KB
MD5

73357a0bc726cf7609144da0964038c6
SHA1

14f94ad87fad3edbadc3e113cea4deb99a989346
SHA256

abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c
SHA512

720429a265bce8ace6a68ae47cc208626857348ac0ea2e91d647ea22e46e34d933890b07581932fe4b63d7b0542294f90fc730b69008c577487e5d05af46d206
SSDEEP

24576:LUbIaDWwJ41fE5nWVIwwgjrRByjrYw0zbw2QKkUtV:LUbIaYCPQj9ByPYw0zfQMt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1272-55-0x0000000000400000-0x0000000000716000-memory.dmp	upx
behavioral1/memory/1272-56-0x0000000000400000-0x0000000000716000-memory.dmp	upx
behavioral1/memory/1272-57-0x0000000000400000-0x0000000000716000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

pid	process
1272	abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe
1272	abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

pid	process
1272	abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe
1272	abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

pid	process
1272	abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe
1272	abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe

C:\Users\Admin\AppData\Local\Temp\abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe
"C:\Users\Admin\AppData\Local\Temp\abeddc9eeec61bf4b932468f5c295635a886034ca7a17bc1e521e3091cd02b0c.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1272-55-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/1272-56-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/1272-57-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download