bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe
Size

1.2MB
MD5

49c1ea63f6ab4ea15e968685f2b233ce
SHA1

cfea01e175c643fa219ec09ccba2cad79bc19273
SHA256

bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7
SHA512

24fe34f26313c48820b7a3e499921d9db425cc9d28c9ad3f90fd170634335fde853900675c7a1f7359934f8b924e12e7570cebad2ce0e2185000e4a649f9520c
SSDEEP

24576:WpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxMA:0EqmvxD3pRaLcZIg+X

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2044	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe
2044	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe
2044	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe
2044	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe
2044	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27
PID 1896 wrote to memory of 2044	1896	bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe	27

C:\Users\Admin\AppData\Local\Temp\bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe
"C:\Users\Admin\AppData\Local\Temp\bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Users\Admin\AppData\Local\Temp\bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe
  "C:\Users\Admin\AppData\Local\Temp\bbba4cf7c65c6f09b16d69eb4d6ca7185a2ea76c307610953ec830fcdde6eba7.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-68-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/2044-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-72-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2044-73-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download