36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512

Analysis

max time kernel
25s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe
Size

1.5MB
MD5

e33a33d1ddced28d500c23f523697bf8
SHA1

b0158fc394e7b48adc0acefc0d601e6224a6022f
SHA256

36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512
SHA512

de1c4e4a69d211b26c77200ad3201bba7a3b2c97b28fb22d8b6f137b6acf108118690c3891904e977d88129722ae78c806b4a02500bb301f84c4685ad5aea0fc
SSDEEP

24576:S5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+B:YIBfvMkrNrf0u3qdaNLgQWiO+h

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1508 set thread context of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1776	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe
1776	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe
1776	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe
1776	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe
1776	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27
PID 1508 wrote to memory of 1776	1508	36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe	27

C:\Users\Admin\AppData\Local\Temp\36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe
"C:\Users\Admin\AppData\Local\Temp\36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\36c937be647d4815da9917bb22b2234d05433d4c15d764b99cec080cebfaf512.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-54-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-55-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-57-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-59-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-61-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-63-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-65-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-68-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1776-69-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-70-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1776-71-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download