44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe
Size

925KB
MD5

669d50484446074268e83aaae4c98178
SHA1

eee91bcdee32972f55600c07917bd4a08a4f7ceb
SHA256

44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699
SHA512

14bb0c784796cf75068f7cf608418e5b8944cf9f9593cae266ccb16cad6d3d955861ff3a5d152acffb6e93904d758cfccec6cbdd2a2d12410d36a2e91b2ad867
SSDEEP

12288:Qmf8PzkvaBHmLV8P22zx+kdJ00Bvuyymhcx1UG6HyNrSjqOuPn6mc2RREYJaR:LSkv/VCWkdJ0OpGmyNtjPn68REYs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1300-55-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/1300-57-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/1300-58-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/1300-62-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/1300-63-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/1300-64-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/1300-65-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1300	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe
1300	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe
1300	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe
1300	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe
1300	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27
PID 1716 wrote to memory of 1300	1716	44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe	27

C:\Users\Admin\AppData\Local\Temp\44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe
"C:\Users\Admin\AppData\Local\Temp\44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe
  "C:\Users\Admin\AppData\Local\Temp\44b6b4eab6ad88bb6c67e9d58128554d43f41e8b1e70845f742416bd6bbd3699.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-54-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1300-55-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1300-57-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1300-58-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1300-61-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1300-62-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1300-63-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1300-64-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1300-65-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download