bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe
Size

1.2MB
MD5

fb169fbdbed2404ffba0f31e9649c7a9
SHA1

8a8e571314af1804404dfb331ef88553be202d48
SHA256

bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38
SHA512

be0ad741da0e01c8b9de4f61d47c35af7dd65ae9c62ef0492d143ace7bd98c0ab56d6f25b502dee5e884158bb0d2ed95540fc3f7581e33104d765045dd2c368b
SSDEEP

12288:NSGxzDKw6w2qa3LgMc8SLFDY/8LeS2899E7D3AYNACMzb7noKcxl4B6obXWRAfb7:Mxw8wFDY3wE3wY6cxI6gWUbIwMLHf/G

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1480	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe
1480	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe
1480	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe
1480	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe
1480	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28
PID 1764 wrote to memory of 1480	1764	bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe	28

C:\Users\Admin\AppData\Local\Temp\bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe
"C:\Users\Admin\AppData\Local\Temp\bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe
  "C:\Users\Admin\AppData\Local\Temp\bc04494b4da8dd29a4c99af5025d3698820b447482193d86dea853183530ad38.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-68-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1480-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1480-71-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download