346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80

Analysis

max time kernel
146s
max time network
143s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 05:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Size

1.5MB
MD5

93b7591aea0b3c85d62c297442065c1a
SHA1

8a897af1325f01f80563e93ed3fec4c9edea60fa
SHA256

346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80
SHA512

b9055c678ac6963b80a8d5f9c486b9c7d8d82fba0fcd61e633c480a6b53f2034b7e0dae87ae3c8e751dfbcf2739440fece7767ff1aeb747402f5d65ff7f7846c
SSDEEP

24576:yFKFSnNeFxih0aX1qC6OqnDoURqtVWAuZJK2MJZmrrXuoC/lwHMTAVyNpL3RV6NQ:ymwNeFxe021u9ZwWnZJK5JcrrI/+sTA2

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

pid	Process
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\123.51pc114.cn	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\51pc114.cn\Total = "63"	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\123.51pc114.cn\ = "63"	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\51pc114.cn	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\51pc114.cn\NumberOfSubdomains = "1"	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
832	346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe

C:\Users\Admin\AppData\Local\Temp\346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe
"C:\Users\Admin\AppData\Local\Temp\346eb3fe421cdc55042c575c13531078856a0aa7c01c9a29e9147b3a8faa2a80.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/832-55-0x0000000000400000-0x000000000061B000-memory.dmp

Filesize
2.1MB

Download
memory/832-57-0x0000000075860000-0x00000000758A7000-memory.dmp

Filesize
284KB

Download
memory/832-465-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-464-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-463-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-467-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-468-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-466-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-473-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-472-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-471-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-470-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-469-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-474-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-476-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-477-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-475-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-478-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-481-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-482-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-480-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-479-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-485-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-486-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-484-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-483-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-489-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-488-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-491-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-492-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-490-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-487-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-493-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-497-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-498-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-496-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-495-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-494-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-502-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-503-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-501-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-500-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-499-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-506-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-507-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-505-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-504-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-508-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-509-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-514-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-513-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-512-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-511-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-510-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-515-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-524-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-523-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-522-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-521-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-520-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-519-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-518-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-517-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-516-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-1381-0x0000000002180000-0x0000000002280000-memory.dmp

Filesize
1024KB

Download
memory/832-1383-0x00000000022C0000-0x0000000002441000-memory.dmp

Filesize
1.5MB

Download
memory/832-4693-0x0000000002180000-0x0000000002280000-memory.dmp

Filesize
1024KB

Download
memory/832-4816-0x0000000002570000-0x0000000002681000-memory.dmp

Filesize
1.1MB

Download
memory/832-4817-0x0000000000400000-0x000000000061B000-memory.dmp

Filesize
2.1MB

Download
memory/832-4818-0x0000000002450000-0x0000000002551000-memory.dmp

Filesize
1.0MB

Download
memory/832-4819-0x0000000000400000-0x000000000061B000-memory.dmp

Filesize
2.1MB

Download
memory/832-4820-0x0000000000400000-0x000000000061B000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads