fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f

Analysis

max time kernel
63s
max time network
69s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe
Size

1.3MB
MD5

ecb8ba810b347288cd1eaeafb456a7ab
SHA1

33b0ecf7904d8fe971b0586e7bbececf36c60936
SHA256

fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f
SHA512

09fe7f5463115224013c7f5a5a56e7b6ae3f9035b5f0d5d382f41f2e58faf76fe14b79add57cd264a6a83a7423e2b2b49bca4b48810943dbe3a332440ce1f46a
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakF:7rKo4ZwCOnYjVmJPae

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
952	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe
952	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe
952	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe
952	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe
952	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28
PID 1656 wrote to memory of 952	1656	fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe	28

C:\Users\Admin\AppData\Local\Temp\fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe
"C:\Users\Admin\AppData\Local\Temp\fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\fb82e66e2711955f4ebcb83d84331486baf404b8ea8fb16dfec25bc7da12f99f.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-68-0x0000000076221000-0x0000000076223000-memory.dmp

Filesize
8KB

Download
memory/952-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/952-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download