6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe
Size

1.1MB
MD5

cfe4b00fab998d07b59f751df5644bee
SHA1

2b7e6e2adb0434d3f13944cb900b456a6dbf714d
SHA256

6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55
SHA512

8cfa76354a869c83d204e0123173eb6521eafc27b277efe44606145bfa139f1abc086cbea4350393623a6e8d08e45fb920b9a012a4976e8184ea6f7a93707a93
SSDEEP

12288:bD3g1pennnnnCsBwGOHBvblq0ib9efT5AB+K10Ojb1uiABW+kH+bl4OEIAzInvTg:FBwFBzFAB+i/bk7kXHw+qBOaqjxKrGH

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 820 set thread context of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2036	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe
2036	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe
2036	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe
2036	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe
2036	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28
PID 820 wrote to memory of 2036	820	6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe	28

C:\Users\Admin\AppData\Local\Temp\6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe
"C:\Users\Admin\AppData\Local\Temp\6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Temp\6a3edfa270b9a7e8a47493fdc1972c264ebba638ddf7448524f7c4865e466f55.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-55-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-57-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-59-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-61-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-63-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-65-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-68-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/2036-69-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-70-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2036-72-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download