a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b

Analysis

max time kernel
9s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe
Size

1.2MB
MD5

a985f413644674d648013096a6191ece
SHA1

23fa98324d3fb642c9e4ab0caeb0336213496b0c
SHA256

a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b
SHA512

8c1084fba9d9526ed052443d7a6f7090159508c91221484368e64e02d97247de8daff426382fe8decba4315fdc0674acd7b219c0f53b2ee634ecd0b25202c4e7
SSDEEP

24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mZ:6MdkS6IsXkRX0bQEgYe709h7

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1548	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe
1548	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe
1548	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe
1548	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe
1548	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28
PID 1808 wrote to memory of 1548	1808	a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe	28

C:\Users\Admin\AppData\Local\Temp\a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe
"C:\Users\Admin\AppData\Local\Temp\a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\a2e0dd7bbd3cf2cbb66fdef5d808b2c0f10209665d8e3d7cd3a115bbdcba648b.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-54-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-61-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-63-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-65-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-68-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1548-69-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1548-72-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download