dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102

Analysis

max time kernel
272s
max time network
358s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe
Size

453KB
MD5

4f3a02e848cfb7dab3f5bbaacc58a298
SHA1

0e4cc0b4884b7f129f6acedd8832bafd6ce7b7c2
SHA256

dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102
SHA512

48c4d75410f10d8c9425d713810309678c332c148ddff1483d182d4c40a1c3f35abdb5b3f85e338d5e2751f3ae3f3defd9c16ba44b46cae38307c8bc935e9c77
SSDEEP

6144:cvaqS4IR/kviXzd4N6qJFldlibYOlU/glqmOgDVL5ul94BhunZQpLzms7VFPZYW:T/kviXzdyGYr/eDVL5ul2unZatP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
756	qfjesjluewfgfyu.exe

Loads dropped DLL 2 IoCs

pid	Process
1156	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe
1156	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	qfjesjluewfgfyu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	756	qfjesjluewfgfyu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
756	qfjesjluewfgfyu.exe
756	qfjesjluewfgfyu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 756	1156	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe	28
PID 1156 wrote to memory of 756	1156	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe	28
PID 1156 wrote to memory of 756	1156	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe	28
PID 1156 wrote to memory of 756	1156	dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe	28

C:\Users\Admin\AppData\Local\Temp\dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe
"C:\Users\Admin\AppData\Local\Temp\dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe
  "C:\Users\Admin\AppData\Local\Temp\\qfjesjluewfgfyu.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
453KB

MD5
4f3a02e848cfb7dab3f5bbaacc58a298

SHA1
0e4cc0b4884b7f129f6acedd8832bafd6ce7b7c2

SHA256
dcd5aa99fa4ada19d93f557e1e597bc49ad394658a9c94a3a9765ffa42dcc102

SHA512
48c4d75410f10d8c9425d713810309678c332c148ddff1483d182d4c40a1c3f35abdb5b3f85e338d5e2751f3ae3f3defd9c16ba44b46cae38307c8bc935e9c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe

Filesize
11KB

MD5
9a7e17351f0e74570b387600922e59e0

SHA1
017bf40ae2cb8321ee9825e3b93339fd41a148da

SHA256
44b9e76377582e04cc2fdc0c6b922634bcda5f9304419ddeac2833610249cc6c

SHA512
bb0bef29d7b60307bf77a81a358d55a7483b1fa81ed3e9453898b1d7629bd1ecab7ec92c505d6522f887549b4604edcdc8a5547b21f66b5c46b84169522f3ba3

Download Submit
\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe

Filesize
11KB

MD5
9a7e17351f0e74570b387600922e59e0

SHA1
017bf40ae2cb8321ee9825e3b93339fd41a148da

SHA256
44b9e76377582e04cc2fdc0c6b922634bcda5f9304419ddeac2833610249cc6c

SHA512
bb0bef29d7b60307bf77a81a358d55a7483b1fa81ed3e9453898b1d7629bd1ecab7ec92c505d6522f887549b4604edcdc8a5547b21f66b5c46b84169522f3ba3

Download Submit
\Users\Admin\AppData\Local\Temp\qfjesjluewfgfyu.exe

Filesize
11KB

MD5
9a7e17351f0e74570b387600922e59e0

SHA1
017bf40ae2cb8321ee9825e3b93339fd41a148da

SHA256
44b9e76377582e04cc2fdc0c6b922634bcda5f9304419ddeac2833610249cc6c

SHA512
bb0bef29d7b60307bf77a81a358d55a7483b1fa81ed3e9453898b1d7629bd1ecab7ec92c505d6522f887549b4604edcdc8a5547b21f66b5c46b84169522f3ba3

Download Submit
memory/756-58-0x000007FEF31E0000-0x000007FEF3C03000-memory.dmp

Filesize
10.1MB

Download
memory/756-59-0x000007FEF2140000-0x000007FEF31D6000-memory.dmp

Filesize
16.6MB

Download
memory/756-61-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

Filesize
8KB

Download