d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120

Analysis

max time kernel
96s
max time network
101s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe
Size

1.3MB
MD5

cc84aa2a4ee85f3772b1bfe0cec3e9a7
SHA1

fffa089189ab6f56781ad1182a8e5fa42d81b6ac
SHA256

d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120
SHA512

f0d301df23e93c59dd7a5669b1b4fdff1da813bfd8266d9f96e0b62edaccef62930f03e820f5b217126b172d4c78347746df905f3b499956f4b9c204c2e986e2
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakb:jrKo4ZwCOnYjVmJPa0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1384 set thread context of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
340	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe
340	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe
340	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe
340	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe
340	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28
PID 1384 wrote to memory of 340	1384	d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe	28

C:\Users\Admin\AppData\Local\Temp\d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe
"C:\Users\Admin\AppData\Local\Temp\d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\d11bc39c9a95b2c8935f9040d5ddb99d9f9f24576f7cac3b72a1e6caab140120.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-68-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/340-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/340-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download