b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3

Analysis

max time kernel
155s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe
Size

4.1MB
MD5

2285bfd07f6cdf95f6500ea528af9ebc
SHA1

4895245815899f4c5c235ed78b38e3058a26ebc6
SHA256

b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3
SHA512

caf9f540f66fe3e3ce26afa24fd58b967bf204cc97d22b94910596840d9cfc989da3c939e6e1c60c55acea143b3b2f5fa23baebad9d96ed5a251a90f8eb35b5e
SSDEEP

24576:sa8vXO9mIJ728+KhUg2dWqQ49FK1DeSdggQMnM/vfrOYxMvGKuMURa/enPDOrUkz:sVfM/afjqz49F8aSdqMM/vy/5R/nrh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions	b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "no"	b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar	b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1956	b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe
1956	b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe

C:\Users\Admin\AppData\Local\Temp\b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe
"C:\Users\Admin\AppData\Local\Temp\b290ba0ffbe28e7e1dcaf77a677f075978a7028322dfaef76693a02ecbfd02d3.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download