2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83

Analysis

max time kernel
243s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe
Size

1.6MB
MD5

feda7371f3a7ed37b3a1872268e3b684
SHA1

0c57cdff56f58e8c3e9fde28dbe3dd0e1e3756de
SHA256

2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83
SHA512

921f34d5901903e7bd8d7e660705b85675035737de31dd1909f7eef6d2ee1cb0406be447119de4208070d4f93ced717d2bef7058ea3198d2b5fe0dbfae1aceee
SSDEEP

24576:9zD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYC:X6/ye0PIphrp9Zuvjqa0Uidt

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 672 set thread context of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
580	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe
580	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe
580	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe
580	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe
580	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28
PID 672 wrote to memory of 580	672	2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe	28

C:\Users\Admin\AppData\Local\Temp\2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe
"C:\Users\Admin\AppData\Local\Temp\2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe
  "C:\Users\Admin\AppData\Local\Temp\2a858b16f5351a1db460e6f54158a7aaf104e538e4c306ba6754e3877caffc83.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-54-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-59-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-61-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-63-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-65-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-68-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download
memory/580-69-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-70-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-71-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/580-73-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download