bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe
Size

485KB
MD5

3c8bff2bb8fd4d1160c6907d0444775e
SHA1

6f49b8e09d29edb661b1c43afeefa4efbad4225c
SHA256

bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521
SHA512

548a89eec0eb7a83ebf72fddab5d1650666baf8dbb8b4117c6a68081a7ae4f8f7db563276533c399d3ca84e210ac8bd065eb4680de7a4f3cd0ff6bc40de4c1e1
SSDEEP

6144:pcDWOguY1NNHLoDZJtUfQQIV6bttQrMaaEMm+FW2fhhxGkEOsEIBvminKVgGtVEA:eMNNkDZDVQIott6yLF7fvxckYGJV7

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1880	oggtsimyxlcg.exe

Loads dropped DLL 2 IoCs

pid	Process
1488	bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe
1488	bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	oggtsimyxlcg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	oggtsimyxlcg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1880	oggtsimyxlcg.exe
1880	oggtsimyxlcg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1880	1488	bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe	28
PID 1488 wrote to memory of 1880	1488	bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe	28
PID 1488 wrote to memory of 1880	1488	bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe	28
PID 1488 wrote to memory of 1880	1488	bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe	28

C:\Users\Admin\AppData\Local\Temp\bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe
"C:\Users\Admin\AppData\Local\Temp\bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\onhbzflolehmqao\oggtsimyxlcg.exe
  "C:\Users\Admin\AppData\Local\Temp\onhbzflolehmqao\oggtsimyxlcg.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onhbzflolehmqao\oggtsimyxlcg.exe

Filesize
32KB

MD5
980e0a41b6618fc1e150067ce23a4794

SHA1
fbf880eefb3f50cff02ea18c3ee3141938ad6411

SHA256
82a15b3f92123258fbe1b2b5954319a1d5b4a3afd51ad8704651d70ad585280b

SHA512
9d7c1e26f0dd3899c68c59326d32dd58c876379922a506ec730a465a838e43f69ea457ba5a7acfa629eeecb7c1b2a89f947663ba72be2b6cf9562c3dfb2b35c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\onhbzflolehmqao\oggtsimyxlcg.exe

Filesize
32KB

MD5
980e0a41b6618fc1e150067ce23a4794

SHA1
fbf880eefb3f50cff02ea18c3ee3141938ad6411

SHA256
82a15b3f92123258fbe1b2b5954319a1d5b4a3afd51ad8704651d70ad585280b

SHA512
9d7c1e26f0dd3899c68c59326d32dd58c876379922a506ec730a465a838e43f69ea457ba5a7acfa629eeecb7c1b2a89f947663ba72be2b6cf9562c3dfb2b35c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\onhbzflolehmqao\parent.txt

Filesize
485KB

MD5
3c8bff2bb8fd4d1160c6907d0444775e

SHA1
6f49b8e09d29edb661b1c43afeefa4efbad4225c

SHA256
bfea8a17ac0f25bc03e4d247a9b9f585cccd4ca54539835d1370ebd115d97521

SHA512
548a89eec0eb7a83ebf72fddab5d1650666baf8dbb8b4117c6a68081a7ae4f8f7db563276533c399d3ca84e210ac8bd065eb4680de7a4f3cd0ff6bc40de4c1e1

Download Submit
\Users\Admin\AppData\Local\Temp\onhbzflolehmqao\oggtsimyxlcg.exe

Filesize
32KB

MD5
980e0a41b6618fc1e150067ce23a4794

SHA1
fbf880eefb3f50cff02ea18c3ee3141938ad6411

SHA256
82a15b3f92123258fbe1b2b5954319a1d5b4a3afd51ad8704651d70ad585280b

SHA512
9d7c1e26f0dd3899c68c59326d32dd58c876379922a506ec730a465a838e43f69ea457ba5a7acfa629eeecb7c1b2a89f947663ba72be2b6cf9562c3dfb2b35c0

Download Submit
\Users\Admin\AppData\Local\Temp\onhbzflolehmqao\oggtsimyxlcg.exe

Filesize
32KB

MD5
980e0a41b6618fc1e150067ce23a4794

SHA1
fbf880eefb3f50cff02ea18c3ee3141938ad6411

SHA256
82a15b3f92123258fbe1b2b5954319a1d5b4a3afd51ad8704651d70ad585280b

SHA512
9d7c1e26f0dd3899c68c59326d32dd58c876379922a506ec730a465a838e43f69ea457ba5a7acfa629eeecb7c1b2a89f947663ba72be2b6cf9562c3dfb2b35c0

Download Submit
memory/1880-59-0x000007FEF4130000-0x000007FEF4B53000-memory.dmp

Filesize
10.1MB

Download
memory/1880-60-0x000007FEF3090000-0x000007FEF4126000-memory.dmp

Filesize
16.6MB

Download
memory/1880-61-0x000007FEFC481000-0x000007FEFC483000-memory.dmp

Filesize
8KB

Download