864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87

Analysis

max time kernel
41s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87.exe
Size

44KB
MD5

6cffad7407f2b9e6c3813b23c3108c90
SHA1

9d7f15e889a26fc23d3a910d41dfdd20c1007d97
SHA256

864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87
SHA512

2e5638dff26afd10116a4ecbc487ac6648c5e14e2287edee17ab0bea70772f66e8f36fe226fc06235c5ed63e1a5b51a118a61838e5ed0f14e8dbd7651a1c46b5
SSDEEP

768:Ve+OQ5GwanEcxu/7T9Bp6LHIlt61CW3dcZDuh6TAfVZf/lxu:Ve8mEFZB1v+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1148	864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87.exe
1148	864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87.exe
1148	864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87.exe

C:\Users\Admin\AppData\Local\Temp\864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87.exe
"C:\Users\Admin\AppData\Local\Temp\864228d1b4f7048b5750919e8eb10e11ed97e1c29356867fdf98e70711960d87.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-56-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/1148-57-0x0000000003D30000-0x0000000004D92000-memory.dmp

Filesize
16.4MB

Download
memory/1148-58-0x0000000005120000-0x0000000005467000-memory.dmp

Filesize
3.3MB

Download