9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a

Analysis

max time kernel
54s
max time network
64s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a.exe
Size

498KB
MD5

a77196d9a1f41065bae8c791624d0ed7
SHA1

c5f5b79462ea35f4a9208c7566c9568a35b83fac
SHA256

9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a
SHA512

9e61f534f9f44bd459b61be1d85997227620b4f8a42e8e3f270238aa908286f1c25cde2484ae32693d84d031f18a7aa2f31b8c2b8da7e2f43e0a8aa858485e0c
SSDEEP

12288:WV+mzk9gSe1VT1+mh6eF947ZUJTioei9W8CSvD99a2YzWd:W839gV1P+mht9c769rt/zYzK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
560	9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a.exe
560	9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a.exe

C:\Users\Admin\AppData\Local\Temp\9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a.exe
"C:\Users\Admin\AppData\Local\Temp\9d00e1e8a73873492a818eac8f6f67b2769ebe9eb3f41cf77dd0b3e95d42794a.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download