ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe
Size

483KB
MD5

4d9dd8badd2555b3f816d39502e234aa
SHA1

991b9ae35d6b6b29bf75013808399d7ee525cecb
SHA256

ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b
SHA512

0f814126c5d8475f4842f5709f0c4483da0a62f1a05c3dbf1990d97c27f9659145b0a2eae81f15f65a3d01f39905c3421c8dc0f3242a8c149a9e249b8655242e
SSDEEP

6144:vKgX4H5EecNFTzZoikyraPkKso6gBBVWqFkPg7bWAfItYVZbIbccH0gusYt:icN1zZoiCsVE30IWAwtYVZRcHg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1112	opsrnrpevolrwo.exe

Loads dropped DLL 2 IoCs

pid	Process
1768	ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe
1768	ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	opsrnrpevolrwo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1112	opsrnrpevolrwo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1112	opsrnrpevolrwo.exe
1112	opsrnrpevolrwo.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1112	1768	ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe	27
PID 1768 wrote to memory of 1112	1768	ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe	27
PID 1768 wrote to memory of 1112	1768	ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe	27
PID 1768 wrote to memory of 1112	1768	ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe	27

C:\Users\Admin\AppData\Local\Temp\ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe
"C:\Users\Admin\AppData\Local\Temp\ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\opsrnrpevolrwo.exe
  "C:\Users\Admin\AppData\Local\Temp\\opsrnrpevolrwo.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\opsrnrpevolrwo.exe

Filesize
31KB

MD5
3ebafa6f4a5bf15644caba74ab816d02

SHA1
ab04c1d1cb8693e601191a4d8b34827a61be5c5c

SHA256
9cad9b6054771c6dfacda569bc7141ce052ab53f5a1627b2e323f94312b2ed06

SHA512
f27884f026a8eacbe0cb6e6cbb143ba2aa41f0a94ec53e9d9ca0778d7412e6625dad13fa0bc840e0b01b14df571eeb3cedbc3352acf7246df8647c8d6b837b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\opsrnrpevolrwo.exe

Filesize
31KB

MD5
3ebafa6f4a5bf15644caba74ab816d02

SHA1
ab04c1d1cb8693e601191a4d8b34827a61be5c5c

SHA256
9cad9b6054771c6dfacda569bc7141ce052ab53f5a1627b2e323f94312b2ed06

SHA512
f27884f026a8eacbe0cb6e6cbb143ba2aa41f0a94ec53e9d9ca0778d7412e6625dad13fa0bc840e0b01b14df571eeb3cedbc3352acf7246df8647c8d6b837b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\parent.txt

Filesize
483KB

MD5
4d9dd8badd2555b3f816d39502e234aa

SHA1
991b9ae35d6b6b29bf75013808399d7ee525cecb

SHA256
ba023b1f287f7a17e689bee6df7fdc9d2b779dac6c121a5b39861c0cf812811b

SHA512
0f814126c5d8475f4842f5709f0c4483da0a62f1a05c3dbf1990d97c27f9659145b0a2eae81f15f65a3d01f39905c3421c8dc0f3242a8c149a9e249b8655242e

Download Submit
\Users\Admin\AppData\Local\Temp\opsrnrpevolrwo.exe

Filesize
31KB

MD5
3ebafa6f4a5bf15644caba74ab816d02

SHA1
ab04c1d1cb8693e601191a4d8b34827a61be5c5c

SHA256
9cad9b6054771c6dfacda569bc7141ce052ab53f5a1627b2e323f94312b2ed06

SHA512
f27884f026a8eacbe0cb6e6cbb143ba2aa41f0a94ec53e9d9ca0778d7412e6625dad13fa0bc840e0b01b14df571eeb3cedbc3352acf7246df8647c8d6b837b7c

Download Submit
\Users\Admin\AppData\Local\Temp\opsrnrpevolrwo.exe

Filesize
31KB

MD5
3ebafa6f4a5bf15644caba74ab816d02

SHA1
ab04c1d1cb8693e601191a4d8b34827a61be5c5c

SHA256
9cad9b6054771c6dfacda569bc7141ce052ab53f5a1627b2e323f94312b2ed06

SHA512
f27884f026a8eacbe0cb6e6cbb143ba2aa41f0a94ec53e9d9ca0778d7412e6625dad13fa0bc840e0b01b14df571eeb3cedbc3352acf7246df8647c8d6b837b7c

Download Submit
memory/1112-59-0x000007FEF49A0000-0x000007FEF53C3000-memory.dmp

Filesize
10.1MB

Download
memory/1112-60-0x000007FEF3900000-0x000007FEF4996000-memory.dmp

Filesize
16.6MB

Download
memory/1112-62-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download