d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe
Size

475KB
MD5

0fa00a5e62c8e1170960b235f747ff9c
SHA1

b2063d9c059b9086ba08e9c189f971cd41110dca
SHA256

d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2
SHA512

cc3b62950af9287187a093b90e3ad000068cc5316a53c609a6541c0e6d99adc4194d8fb05a2544987f140e87ac9c7deb551f35af3514ff432c2cef4010892404
SSDEEP

12288:EQR17Zoi9I6ilkSE9RiTyR79Osvq2aqpU3gBJ:pZoifUyssvq2Xp5

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1832	auukrlnmsuov.exe

Loads dropped DLL 2 IoCs

pid	Process
1960	d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe
1960	d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	auukrlnmsuov.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	auukrlnmsuov.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1832	auukrlnmsuov.exe
1832	auukrlnmsuov.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1832	1960	d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe	28
PID 1960 wrote to memory of 1832	1960	d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe	28
PID 1960 wrote to memory of 1832	1960	d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe	28
PID 1960 wrote to memory of 1832	1960	d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe	28

C:\Users\Admin\AppData\Local\Temp\d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe
"C:\Users\Admin\AppData\Local\Temp\d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\auukrlnmsuov.exe
  "C:\Users\Admin\AppData\Local\Temp\\auukrlnmsuov.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\auukrlnmsuov.exe

Filesize
23KB

MD5
aa11debfeedd9a06ace76db52cb678a2

SHA1
89d507dd84c2adf8ca4dc5dce023a85af4ec25af

SHA256
4ad6d06d6b086602365c4fc2c5bbd1b8f65b252a379e21f3b22fe8dbb8e9aea7

SHA512
4151130b35305b8110f7a0b5b51774532f8599ca4c558d25c49419607e402bc29d8e9cf340e2bdabcfb6c0a3a8352437b0306cb962f7b6104179df02cffe2042

Download Submit
C:\Users\Admin\AppData\Local\Temp\auukrlnmsuov.exe

Filesize
23KB

MD5
aa11debfeedd9a06ace76db52cb678a2

SHA1
89d507dd84c2adf8ca4dc5dce023a85af4ec25af

SHA256
4ad6d06d6b086602365c4fc2c5bbd1b8f65b252a379e21f3b22fe8dbb8e9aea7

SHA512
4151130b35305b8110f7a0b5b51774532f8599ca4c558d25c49419607e402bc29d8e9cf340e2bdabcfb6c0a3a8352437b0306cb962f7b6104179df02cffe2042

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
475KB

MD5
0fa00a5e62c8e1170960b235f747ff9c

SHA1
b2063d9c059b9086ba08e9c189f971cd41110dca

SHA256
d56807db70688457fd74b2f3678a2d9dffd2d62357fdb595a344a293a3d6f6f2

SHA512
cc3b62950af9287187a093b90e3ad000068cc5316a53c609a6541c0e6d99adc4194d8fb05a2544987f140e87ac9c7deb551f35af3514ff432c2cef4010892404

Download Submit
\Users\Admin\AppData\Local\Temp\auukrlnmsuov.exe

Filesize
23KB

MD5
aa11debfeedd9a06ace76db52cb678a2

SHA1
89d507dd84c2adf8ca4dc5dce023a85af4ec25af

SHA256
4ad6d06d6b086602365c4fc2c5bbd1b8f65b252a379e21f3b22fe8dbb8e9aea7

SHA512
4151130b35305b8110f7a0b5b51774532f8599ca4c558d25c49419607e402bc29d8e9cf340e2bdabcfb6c0a3a8352437b0306cb962f7b6104179df02cffe2042

Download Submit
\Users\Admin\AppData\Local\Temp\auukrlnmsuov.exe

Filesize
23KB

MD5
aa11debfeedd9a06ace76db52cb678a2

SHA1
89d507dd84c2adf8ca4dc5dce023a85af4ec25af

SHA256
4ad6d06d6b086602365c4fc2c5bbd1b8f65b252a379e21f3b22fe8dbb8e9aea7

SHA512
4151130b35305b8110f7a0b5b51774532f8599ca4c558d25c49419607e402bc29d8e9cf340e2bdabcfb6c0a3a8352437b0306cb962f7b6104179df02cffe2042

Download Submit
memory/1832-59-0x000007FEF4090000-0x000007FEF4AB3000-memory.dmp

Filesize
10.1MB

Download
memory/1832-60-0x000007FEF23B0000-0x000007FEF3446000-memory.dmp

Filesize
16.6MB

Download
memory/1832-62-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmp

Filesize
8KB

Download