Analysis

  • max time kernel
    117s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 17:24

General

  • Target

    4a120a25bb58ff6ac470678b9a5625b423c4555de3425041a495959c737a7dd5.exe

  • Size

    367KB

  • MD5

    f79ac1396ea7aca7f2212affe0ef0c47

  • SHA1

    1fb05490843bed336636d584156bdca3ec1c6135

  • SHA256

    4a120a25bb58ff6ac470678b9a5625b423c4555de3425041a495959c737a7dd5

  • SHA512

    547ed2068a64d4e5cebe3e9cde98bd53f6978cf18684d74d2278050f72bc5292becab516d3585ada1b37e40315f080c934867b6bb1d98074a7d24774f6ce792d

  • SSDEEP

    6144:mOwh11PzqzZBljxZ6bJyfDIZK8oW+vwXvEd7Pgr1FHr8v20xTcRoM+mN5t:mOwh11Pzqzci071vagfL8vNNsoM+8n

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a120a25bb58ff6ac470678b9a5625b423c4555de3425041a495959c737a7dd5.exe
    "C:\Users\Admin\AppData\Local\Temp\4a120a25bb58ff6ac470678b9a5625b423c4555de3425041a495959c737a7dd5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1120

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ER0DS634.txt

    Filesize

    603B

    MD5

    11ad7277aedfe28521611d5d36e2c2be

    SHA1

    9903767b60ac87fdc40de3edd17d91316ff50966

    SHA256

    dfc5b9dbf99e4462827bd696feb98116a1ff2b56ae3d65e54b386e4ce3563abe

    SHA512

    362e09da23ab05159876e8c4acf5f206c30249bab9a9c05e1442a2821926d533685cc9c343dfb34bd6edd4d7807f6a01e81e47956b8d9dfa1ed02d4241d5f0e7

  • memory/1196-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

    Filesize

    8KB

  • memory/1196-55-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1196-56-0x0000000001C60000-0x0000000001CAE000-memory.dmp

    Filesize

    312KB

  • memory/1196-58-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/1196-59-0x0000000001C60000-0x0000000001CAE000-memory.dmp

    Filesize

    312KB