49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933

Analysis

max time kernel
64s
max time network
68s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe
Size

1.2MB
MD5

bb0fff3cbbf29f31a0d342276f5be725
SHA1

72a502f5dbc339183d9fc36a5d988d84ba4fd2de
SHA256

49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933
SHA512

d8e48f8b8d3386db1e4a0f65f59a9d3d079055cd734e512570742e150414179d84e61cd42d0f4a1083d5375eff4ad49ec80862177f5929e75b8d84dc6528d671
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM:EEqmvxD3pRaLcZIg+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
948	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe
948	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe
948	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe
948	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe
948	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27
PID 960 wrote to memory of 948	960	49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe	27

C:\Users\Admin\AppData\Local\Temp\49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe
"C:\Users\Admin\AppData\Local\Temp\49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe
  "C:\Users\Admin\AppData\Local\Temp\49b57aae80e4cddbc055cbe94d7d89a888006149eb172a49df09b62afbc44933.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-68-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/948-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-72-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download