254ac33bace6896ffa1cd789959eea2abe69f36fefa7445421d4266378e79a35

Analysis

max time kernel
60s
max time network
135s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PSDico.exe
Size

3.3MB
MD5

83db3fc5ac419a1f55d1482e55ade37d
SHA1

1bb95c8d37dd05b552167e2b1ddccf6b67761b9d
SHA256

7ce45beb6390bf6bdc332257e4957dfeeca0aad3e92501dff3bec68f88ea15c5
SHA512

ee4e62502b30f58e4c44747addefff608a3c525f6f1cfc39239e893e456646b4547a382ddb213f09ee542279075260ed82a961c69bccc5cffd55c324433d4781
SSDEEP

98304:Pni6623JdHPYaNwVZc1QpOiMBelU2UcDqFJ:haAQpxvMcDw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	PSDico.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	PSDico.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1324	PSDico.exe
1324	PSDico.exe

C:\Users\Admin\AppData\Local\Temp\PSDico.exe
"C:\Users\Admin\AppData\Local\Temp\PSDico.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download