906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df

Analysis

max time kernel
232s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe
Size

1.3MB
MD5

f8077d33638bb5fe9ecc6d215b23795a
SHA1

e8e05ebab042d5d61a4635226462d179ff594319
SHA256

906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df
SHA512

136d1fb844d9cf383d514fcdefec0a66e1132cb70af1053a484d548f7fe51803a4dd25cc71e6060c8e2f6e6e135ce80bec90d80afcbbfce3ec2ff417a01d0558
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakh:7rKo4ZwCOnYjVmJPaK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
588	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe
588	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe
588	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe
588	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe
588	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28
PID 1152 wrote to memory of 588	1152	906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe	28

C:\Users\Admin\AppData\Local\Temp\906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe
"C:\Users\Admin\AppData\Local\Temp\906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\906d5585ad9d9aac7ee668109391b13f232585ff4ce1c0cb3e12faac809237df.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-68-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/588-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-72-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/588-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download