dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe
Size

1.3MB
MD5

38e45c56bd3e50b62e879bbfc8819b9b
SHA1

7aa1dce07cc19dff6f0873312230c4ac633e5b06
SHA256

dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61
SHA512

0995f53cd8fcc5a5f173ce6f80f1fbc82061980f9581f9b820307ce0a430a1fc35e47d915d84decc279dbacace000fd008560d4bf8021a951e9918ba27ea595b
SSDEEP

24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakC:TrKo4ZwCOnYjVmJPat

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1196	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe
1196	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe
1196	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe
1196	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe
1196	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27
PID 1976 wrote to memory of 1196	1976	dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe	27

C:\Users\Admin\AppData\Local\Temp\dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe
"C:\Users\Admin\AppData\Local\Temp\dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\dba739c6dfcb83ac9edbbbd29e678d938679cc43197b1f1d297874c71aa7ec61.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-68-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1196-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1196-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download