c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753

Analysis

max time kernel
20s
max time network
62s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe
Size

1.2MB
MD5

ae78bfcfbf4c68e35342ab7bf766d0e4
SHA1

325ff6f422da698e3e3dc19294ecdde735428512
SHA256

c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753
SHA512

04df50e4b85a6a081b72e3744bc6df0f7bc5ee682278396aeda89962dfc7ab159fdf3d55a56b04eeba11a21b54120147b8fb8d66819495d883bd6ff015230044
SSDEEP

24576:GpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxMY:kEqmvxD3pRaLcZIg+z

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
948	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe
948	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe
948	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe
948	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe
948	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28
PID 1216 wrote to memory of 948	1216	c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe	28

C:\Users\Admin\AppData\Local\Temp\c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe
"C:\Users\Admin\AppData\Local\Temp\c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe
  "C:\Users\Admin\AppData\Local\Temp\c761f29b6746eb9635c451b8ab259e0f27f696cfcf65e0d3327aea81e5087753.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-68-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/948-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-71-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/948-73-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download