7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b

Analysis

max time kernel
255s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b.exe
Size

292KB
MD5

2ccb3ab1622fe3267b8553e6d93d92fd
SHA1

c08287bc0d255ab4d1e74a530d7b5bdbd9079349
SHA256

7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b
SHA512

35594356d8ae91b93d4aca3b27b0ae4c6e3853255aac0156ad4795a31bb37ddc34532242bb5810bce5efd1dba15f1593c6a3a8d3365d62d5e95f845d6c974b20
SSDEEP

6144:+azk6Yp31nsW55hJ0Wr885YLv/0N3arJt6ZwDgjWEA5kddbdSi:+a2h1j5PK8SIRarJtkwDQYCEi

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/756-55-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
756	7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
756	7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b.exe
756	7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b.exe

C:\Users\Admin\AppData\Local\Temp\7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b.exe
"C:\Users\Admin\AppData\Local\Temp\7164017bdf1ce84cc09e2253044a9d0b59c572e22705979c67744aaca17a2b7b.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/756-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/756-56-0x0000000000820000-0x0000000000844000-memory.dmp

Filesize
144KB

Download
memory/756-57-0x0000000000820000-0x0000000000844000-memory.dmp

Filesize
144KB

Download
memory/756-67-0x0000000000820000-0x0000000000844000-memory.dmp

Filesize
144KB

Download