5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6

Analysis

max time kernel
234s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Size

665KB
MD5

cb099797970fbb603bdec881c8d42d6f
SHA1

dadeae5cc1ea4f7414f068ff01daaa9a370a1f25
SHA256

5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6
SHA512

374a2f579c40b7ba63cf765f78be7d2090bd5ef93f0fde4a6eb8d62d9080afb42da8379fec4d0763d082ea0cec29a46bf9de67139418acddc28ec0bfab4a43af
SSDEEP

12288:OS3NhIPYYE49Se82bBv7qYaX+jx0tete2uVVlxyKjYYL3SNokDzPM5lK:h9LYuehbBzqYM+jx0gVgVlhYA4vbMnK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler\ = "this is my ebook"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler\Clsid	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.MyNSHandler"	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1112	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
1112	5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe

C:\Users\Admin\AppData\Local\Temp\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe
"C:\Users\Admin\AppData\Local\Temp\5003a88fff72f1dd53fe6c90871a035f81966daa6ed821523923618819372ba6.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-54-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download