838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e

Analysis

max time kernel
232s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe
Size

36KB
MD5

8003a98ad9f89c1a3eeece36dde0b435
SHA1

d7cb905e0679184f7df5036a291694ce6425168b
SHA256

838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e
SHA512

3b9cdcd377a90f06fc7214bdc982a9beb1effd8497da84297127c396f3821521b4c13871497bea94221722d0f094846977c61b22841bce5232d3b1bf85e8a1af
SSDEEP

768:KE1OBaz1yFInIw9XjB9iVkOLQZz6L+3IoFKrYut1eYVxCIS6I1qy8:KIEF8VNulUNr

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\irc.txt	838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
580	838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe
580	838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe
580	838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe

C:\Users\Admin\AppData\Local\Temp\838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe
"C:\Users\Admin\AppData\Local\Temp\838cb2afc7c651f24a627339d8f1cea79e83f78b516e42ca90bcea6c61e0d75e.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-56-0x0000000076D71000-0x0000000076D73000-memory.dmp

Filesize
8KB

Download