697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270

Analysis

max time kernel
127s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270.exe
Size

2.1MB
MD5

6225288f8671818a19fd349f2df50d1e
SHA1

1946f1125f95cded4f3d71eca14e3b66590aa391
SHA256

697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270
SHA512

d967e8b2da77af2fbc258929b5ff566f74f872ce889a04ebeaadacd99a3282afdfd7a42668df5e0e211db3ce12381b92a281dc54d0430b8ed04d1eb1411faa94
SSDEEP

49152:HSO1YWxfof1x8w6iNSH+IpCL7FEjF8BH0CIvBIgph:ySYufodf64SH+IUcF8p0COx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1212	697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270.exe
1212	697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270.exe

C:\Users\Admin\AppData\Local\Temp\697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270.exe
"C:\Users\Admin\AppData\Local\Temp\697583501773a69c70013d5a671ed1c84360dd7629955b9dcc9a38f361424270.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-54-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

Filesize
8KB

Download