f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80

Analysis

max time kernel
55s
max time network
64s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe
Size

1.5MB
MD5

18fd4f3e6c711395ba81e277d78f6c9f
SHA1

c4386147639ef2490e31d51bcd3673da148403a9
SHA256

f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80
SHA512

4cad94eac5d449b0f73a89a3a0a057c6dbf2fa93558340b4a9a0cec04adcbde1a4e1dc920e978f7739129e6f07ee4a29833ec5102b562425efc88d8146adcd3b
SSDEEP

24576:1zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY2:P6/ye0PIphrp9Zuvjqa0UidJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2016	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe
2016	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe
2016	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe
2016	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe
2016	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28
PID 1756 wrote to memory of 2016	1756	f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe	28

C:\Users\Admin\AppData\Local\Temp\f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe
"C:\Users\Admin\AppData\Local\Temp\f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe
  "C:\Users\Admin\AppData\Local\Temp\f9bd7667eb2c4bdf2ea65436ead8b8297721f00ae430a557e7a6b00489735d80.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-68-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/2016-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-71-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-73-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download