abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2

Analysis

max time kernel
31s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe
Size

961KB
MD5

752d92bb7e296564cdb4056c966a2442
SHA1

2169e363149c08ad0395121e84a724918746324c
SHA256

abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2
SHA512

63a439c48fc20c1e3385bc9feb1e2765e03299be39d5308e0d29870f3c958e010f6fdb3cd80feb447c8ec8d2ce0341331d9e0d1b8cf07f6a0105a4c4f0602b4e
SSDEEP

24576:LUbIaDWwJ41fE5nWVIwwgjrRByjrYw0zbw2QKkUtV:LUbIaYCPQj9ByPYw0zfQMt

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2036-55-0x0000000000400000-0x0000000000716000-memory.dmp	upx
behavioral1/memory/2036-56-0x0000000000400000-0x0000000000716000-memory.dmp	upx
behavioral1/memory/2036-57-0x0000000000400000-0x0000000000716000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

pid	process
2036	abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe
2036	abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

pid	process
2036	abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe
2036	abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

pid	process
2036	abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe
2036	abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe

C:\Users\Admin\AppData\Local\Temp\abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe
"C:\Users\Admin\AppData\Local\Temp\abe7edef73d804db48d481337b8d75e07c16179bc00a21eee76621b8413f42c2.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/2036-56-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download
memory/2036-57-0x0000000000400000-0x0000000000716000-memory.dmp

Filesize
3.1MB

Download