Analysis

  • max time kernel
    29s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 12:12

General

  • Target

    d14f00abe46a89993b721c0a65d6ae0905f2fe1da780e412a93b06de2fd392b6.exe

  • Size

    1.3MB

  • MD5

    abc2d010698d22f88ffb8c8c581e1263

  • SHA1

    cb063081fdd1e78818615074792700d843e3d5db

  • SHA256

    d14f00abe46a89993b721c0a65d6ae0905f2fe1da780e412a93b06de2fd392b6

  • SHA512

    e03b820b8cb1521c70cce332810eb6a04b7fe2b92f2ea8ca056e060387be14900fb1bbd01cf24b2fe910f41510565373994cbc30df9073e539568edeeac6e0c8

  • SSDEEP

    24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakD:7rKo4ZwCOnYjVmJPaA

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d14f00abe46a89993b721c0a65d6ae0905f2fe1da780e412a93b06de2fd392b6.exe
    "C:\Users\Admin\AppData\Local\Temp\d14f00abe46a89993b721c0a65d6ae0905f2fe1da780e412a93b06de2fd392b6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Users\Admin\AppData\Local\Temp\d14f00abe46a89993b721c0a65d6ae0905f2fe1da780e412a93b06de2fd392b6.exe
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1608-54-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-55-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-57-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-59-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-61-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-63-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-65-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-68-0x0000000076261000-0x0000000076263000-memory.dmp

    Filesize

    8KB

  • memory/1608-69-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-70-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB

  • memory/1608-72-0x0000000000400000-0x00000000004D9000-memory.dmp

    Filesize

    868KB