ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2

Analysis

max time kernel
109s
max time network
175s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
Size

1.3MB
MD5

353fd631d680e876b57f29b64bcd20a6
SHA1

82d44e1868f3e260421919160d0f3665f80f3758
SHA256

ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2
SHA512

b605d17d315e1f94d5fa0a3efb4d7b4b3ead5128a34cd158cccb862f0386567020c164f6c2d600e8e84825dd3b68c9ea9dae65ff7afba0951dd0d2ce719f8ab8
SSDEEP

24576:rrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:rrKo4ZwCOnYjVmJPah

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1672	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
1672	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
1672	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
1672	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
1672	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28
PID 1404 wrote to memory of 1672	1404	ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe	28

C:\Users\Admin\AppData\Local\Temp\ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
"C:\Users\Admin\AppData\Local\Temp\ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\ff96e0d5643dc7629008de8ac1d6a43a31b9e962f98c13da155710073ab677d2.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-68-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1672-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1672-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download