f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04

Analysis

max time kernel
72s
max time network
124s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe
Size

1.1MB
MD5

388871239a74f0769202bb50085e0280
SHA1

f494b8cbfe00bb874d7f3e5840c639688635de3b
SHA256

f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04
SHA512

0059ed715f3ea20cc991ecfde74e222320bd89a0ee60e4f5d28cbce9c63498f582ed9ef0e2f44398fca622a744211fc6f5f4f9a0388ca904d22cd73b5a32a3a9
SSDEEP

24576:zLOW8gHxw5M24yEv7cIeTPA/VEzbMWHe/Q/l5BtUqQsLM7GQqKMEdL:EgROM27ocFSXIvnaOEF

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1772 set thread context of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1052	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe
1052	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe
1052	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe
1052	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe
1052	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28
PID 1772 wrote to memory of 1052	1772	f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe	28

C:\Users\Admin\AppData\Local\Temp\f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe
"C:\Users\Admin\AppData\Local\Temp\f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\f59d4dd56cab2a6495aedf91ce352ee2fa764cc5eba9e47b9285b83d20cdce04.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-54-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-55-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-57-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-59-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-61-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-63-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-65-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-66-0x000000000044E28C-mapping.dmp

Download
memory/1052-68-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1052-69-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-70-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-71-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1052-73-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download