47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb

Analysis

max time kernel
231s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe
Size

1.4MB
MD5

ee66793556d32b06e92e64087c25c618
SHA1

067b4b4a0630c2cdb1cbfdd92c05eb9fecaa59d1
SHA256

47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb
SHA512

0b6daaa0b28d6e8a553bfbcce77fc337a319e38c8cbe820d44227033b81a73ebd3ef644ff8b372cdccba67fec1689e23451b45a74d54809946f6dc6cb9b0ae0e
SSDEEP

24576:BrK6dClXmekxlm1dl4r260n4dz0as5jc3AZ1COwiUP/5lq8A5:BrBew72604doSw6ewS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1508	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe
1508	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe
1508	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe
1508	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe
1508	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28
PID 1032 wrote to memory of 1508	1032	47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe	28

C:\Users\Admin\AppData\Local\Temp\47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe
"C:\Users\Admin\AppData\Local\Temp\47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\47e3a111e8952cd23a2cbd1633f4ff414f35c9d49951ceebb105934b639019cb.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-54-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-55-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-57-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-68-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1508-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-70-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-71-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/1508-73-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download