30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717

Analysis

max time kernel
167s
max time network
90s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717.exe
Size

554KB
MD5

c631787045d8c1c28736427c59576c74
SHA1

561eba785b7dd5cf2942c40a0bc5f0f51dc42fa2
SHA256

30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717
SHA512

c1c69a202f9c36e5701b2d7ab7ee10d6fa296c6dcff8ad7bc47759ceeeff2258ed7a11323e31e09bdd5422681a4de1e351e75276d5b12d92f2a95e1b1bbb64de
SSDEEP

6144:Sx8PuigkhIVjBwNIoM+vLWpIRJy5dugtFDD8f9luhuKf67VlgJOD4Bfvdl4KyzzV:SRpVNE3Wpy4ugL3AuhuaOD490KqKfjl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1600	30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717.exe
1600	30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717.exe

C:\Users\Admin\AppData\Local\Temp\30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717.exe
"C:\Users\Admin\AppData\Local\Temp\30e6dc6ca4dbc8e8511430c6f4aed5840b8640585995dfee49f05b285f435717.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/1600-56-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download