cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d

Analysis

max time kernel
64s
max time network
91s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe
Size

1.2MB
MD5

5029bb32a490f79849cd57c5944621d9
SHA1

ed346f4379c4a70d8c70e9c84ce6e8c8f891fcd0
SHA256

cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d
SHA512

d6128620a33cdbba475c67ca715aca47968531d1a2c66976acc4c3cf8893acf1eeb7f74cebc330169ac0ed8efe817702d204356cda3a455dff7378ed8592c458
SSDEEP

24576:/pEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxMy:hEqmvxD3pRaLcZIg+p

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2016	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe
2016	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe
2016	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe
2016	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe
2016	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28
PID 2004 wrote to memory of 2016	2004	cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe	28

C:\Users\Admin\AppData\Local\Temp\cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe
"C:\Users\Admin\AppData\Local\Temp\cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Users\Admin\AppData\Local\Temp\cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe
  "C:\Users\Admin\AppData\Local\Temp\cb4ea91391720f0e61f7ed04187cb94fc1e674cd5ebc5bca37eabbc64391414d.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-68-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/2016-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-71-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2016-73-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download