cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66

Analysis

max time kernel
236s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66.exe
Size

124KB
MD5

baf346d88b2debd1183f53fccc1f87d4
SHA1

a703dc87d8309119c8a37df3852985f785fd0aac
SHA256

cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66
SHA512

3e47d8db73a38ff1e0052031ff5b76f3ec6cae22145098457130ca954d91e6b34d8f31ebb25ab17206e31f292bfa29b59e3bb83765382ca40bf3a02ade229a20
SSDEEP

3072:8ZvuCErCoXkdbTLBAMrAEi9/axmkycm9cmqJkdLYtGSN+99u:8ZvuCYX6bmERmkbXFJ/cSNg9u

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
828	cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
828	cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66.exe
828	cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66.exe

C:\Users\Admin\AppData\Local\Temp\cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66.exe
"C:\Users\Admin\AppData\Local\Temp\cdf4f06d2d1f68331d3a548a20719e0054bb57b3e187aacc6b1a51b278caac66.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download