eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b

Analysis

max time kernel
55s
max time network
72s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe
Size

1.5MB
MD5

b1b19d4140acaa1feb180ad5e8e905a1
SHA1

73238980ece2bcfa82e6c7e11040d38745628015
SHA256

eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b
SHA512

8a13decafea91978e691b2104ab2e164601ca1fe58550154a8e0955a92ee0d7888d3534b2936aa81bf2c6f3b6827ab19a991b26c50a01d958df5fe3eed014690
SSDEEP

24576:t5IM/V0deM5lZ2ykPYMkrQ1OrWaRyv2PBcSL+L5/+FMoQl/ugQWiBdrfO+a+H:TIBfvMkrNrf0u3qdaNLgQWiO+n

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1152	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe
1152	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe
1152	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe
1152	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe
1152	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27
PID 848 wrote to memory of 1152	848	eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe	27

C:\Users\Admin\AppData\Local\Temp\eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe
"C:\Users\Admin\AppData\Local\Temp\eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\eb99d9667b27cbab2b12495f83957a06ce70e6a34559ed621113514efaaa281b.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-54-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-55-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-57-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-59-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-61-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-63-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-65-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-68-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1152-69-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-70-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-71-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1152-73-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download