812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be

Analysis

max time kernel
34s
max time network
86s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
Size

1.2MB
MD5

55a418a32f4e2865045fb8dd7f26f2a8
SHA1

cf2108ecd7cc7b4f1730b217d0b9c712c77b29e8
SHA256

812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be
SHA512

ec4d6f3374bc1ca9f37f797cb12a14c3b06acfc1db76a4d15d050608bfca5ead3fdabff6c21c5c60a22b6fe0c8b59a2c875301d3d496a1588131da3188692a5b
SSDEEP

24576:mpEdL1+miBQxprjUQftJLpV1VnaLcpI4Ig+JxM:EEqmvxD3pRaLcZIg+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1940	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
1940	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
1940	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
1940	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
1940	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28
PID 2020 wrote to memory of 1940	2020	812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe	28

C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
"C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe
  "C:\Users\Admin\AppData\Local\Temp\812e94bea8b2a9466b0b481ff8eca495647b3245166d7ee5445643112b1864be.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-68-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1940-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1940-72-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download