7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7

Analysis

max time kernel
52s
max time network
95s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
Size

1.3MB
MD5

a6e4165f46c3b02603642cc8ca064fd9
SHA1

80e9eeca9b4be75fb906bcf496fa5d0d354e27f7
SHA256

7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7
SHA512

af17774d8477cab6ec585f2200219210025ad63f83bb637e5f791eef8cb8122aa70973b4e7cf9ccb5f7da724eb78e76face38a2e211d6d2a4f70a8a75f9987a4
SSDEEP

24576:GKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcuj:GKVzMNuwIKyoBmnMSURNQD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1456	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
1456	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
1456	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
1456	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
1456	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28
PID 848 wrote to memory of 1456	848	7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe	28

C:\Users\Admin\AppData\Local\Temp\7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
"C:\Users\Admin\AppData\Local\Temp\7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\7061ce65a4eb0268437f989ab6b27cb2d5bd7edef9ce8fe049860a57edc360b7.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-66-0x000000000044D5E3-mapping.dmp

Download
memory/1456-68-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1456-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-72-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1456-73-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download