d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340

Analysis

max time kernel
101s
max time network
107s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe
Size

22KB
MD5

38ddb51e61cf2c505983990acf238d40
SHA1

1a141c540dc6ff6eb1976056c87bee30f8542505
SHA256

d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340
SHA512

10b76a8bfb55f17469dca1fbe9cc4b3d92a5af84c7137def35471cca49c72188834f2206a9ad9e91cccfa0f2133a7f731e5e726961a454c7ee04a290a0611630
SSDEEP

384:ecnE0N9TugdeVfaO+BWVHcufg/1uR07MGLfBGmFRRZYcfH6kLm8:ecnHN9T9eBgWVHcufs8+7zVGa1Y8vLm8

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1592	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\L = c19a939adbd39a929a82d3d4829bc99a919bd39a999a82d3d4929092928d9192829bc99a919bd39a949a82c7d5c9c4829bd39a93989a82db97a699a6999791918d919298a18d9496a2968d999793998d989897a2979196a491949194dd829bdd60000000	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1592	1388	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe	30
PID 1388 wrote to memory of 1592	1388	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe	30
PID 1388 wrote to memory of 1592	1388	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe	30
PID 1388 wrote to memory of 1592	1388	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe	30
PID 1388 wrote to memory of 1592	1388	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe	30
PID 1388 wrote to memory of 1592	1388	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe	30
PID 1388 wrote to memory of 1592	1388	d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe	30

C:\Users\Admin\AppData\Local\Temp\d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe
"C:\Users\Admin\AppData\Local\Temp\d98273f0e7efc7905a52297aaae97b9f687bd344cf3dfde3c2ac9d78185f6340.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\update.bat
  2⤵
  - Deletes itself
  PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\update.bat

Filesize
292B

MD5
b1b219422e80ccdcf9e671834338bbd5

SHA1
897244c9c17b0c68589357b9a807167cc307d31f

SHA256
46b417aa6bd7cccd1e8cb7b255d417d7a9c3f1e25dcbbf3225458b15eb8c22d1

SHA512
a07700ecb809042b03821fb21db2e100f841bc487ee68b306c9b3efc261eb52875a76461331ebdbf5c3ea2088fdaece2a3bbaf6e1853fc298ff06911f95a2bf4

Download Submit
memory/1388-54-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download