Analysis
-
max time kernel
53s -
max time network
96s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
Resource
win10v2004-20221111-en
General
-
Target
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
-
Size
1.3MB
-
MD5
8340b417bdcc72bb63ce34161902b590
-
SHA1
b00b101abbd9e9527eb35c25da9e4c3cbdd7b50b
-
SHA256
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c
-
SHA512
74c41353fd2db27b95da97e1bd496cd88785c3112e9ae9a92cf78ba128b0625fc095aeb33710b725311a2ef8f0acbf7bc87e33cea4d56fdf8b60ce69451127c9
-
SSDEEP
24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakn:zrKo4ZwCOnYjVmJPaw
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exedescription pid process target process PID 1996 set thread context of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe -
Processes:
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exepid process 2008 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe 2008 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe 2008 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe 2008 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe 2008 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exedescription pid process target process PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe PID 1996 wrote to memory of 2008 1996 d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe"C:\Users\Admin\AppData\Local\Temp\d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\d2ea310629475e04be8ee77a29cf9224729cda7c6f5c07c4f588524082e17f9c.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2008