6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c

General

Target

6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
Size

1.3MB
MD5

65a295df2d36d227c7e02206ca3d7c35
SHA1

53bfe9892cdf8eeb2a5b7402d0326db809f4f519
SHA256

6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c
SHA512

1486b852312ea4c16be0dce83d06d2f3ee09c80f4a0337a68a2baf519a8966d992dc8a7e0944dae656c062e981c7128865a9976650c4f6b94f15a2c59edfe9ea
SSDEEP

24576:jrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak+:jrKo4ZwCOnYjVmJPaR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

description	pid	process	target process
PID 1104 set thread context of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

pid	process
1748	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
1748	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
1748	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
1748	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
1748	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

description	pid	process	target process
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
PID 1104 wrote to memory of 1748	1104	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe	6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe

C:\Users\Admin\AppData\Local\Temp\6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
"C:\Users\Admin\AppData\Local\Temp\6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\6c2095d3c5fb1b3acbc22d4b7796b1cc88b9efc384b704330b4a0f9e62b4840c.exe
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-66-0x000000000044E057-mapping.dmp

Download
memory/1748-68-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1748-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1748-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads