Analysis
-
max time kernel
39s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:12
Static task
static1
Behavioral task
behavioral1
Sample
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe
Resource
win10v2004-20220812-en
General
-
Target
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe
-
Size
1.6MB
-
MD5
3a453fbc8fef58ac420b49acc18243d7
-
SHA1
6eb098bc55aacc0d5bfc4bd4eca5fa30926beac7
-
SHA256
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc
-
SHA512
8b6c66b6eaa084276466cdede1ffa93806a2ca1a525e765c7b5b677eaf9a4e8d11959ea88424538b652e9cdeaeccfbddc174c7bc28e495da414ac205392bfdb1
-
SSDEEP
24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY0:X6/ye0PIphrp9Zuvjqa0UidH
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exedescription pid process target process PID 1744 set thread context of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe -
Processes:
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exepid process 996 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 996 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 996 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 996 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 996 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exedescription pid process target process PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe PID 1744 wrote to memory of 996 1744 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe 6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe"C:\Users\Admin\AppData\Local\Temp\6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe"C:\Users\Admin\AppData\Local\Temp\6cb4dfa475e3f4d05a98d58ff190a7e9d9974108d62a00929ec89347d1206edc.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-54-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-55-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-57-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-59-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-61-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-63-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-65-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-66-0x000000000045304C-mapping.dmp
-
memory/996-68-0x0000000076DC1000-0x0000000076DC3000-memory.dmpFilesize
8KB
-
memory/996-69-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-70-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB
-
memory/996-72-0x0000000000400000-0x00000000004DF000-memory.dmpFilesize
892KB