663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484

Analysis

max time kernel
78s
max time network
80s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe
Size

25KB
MD5

1a79071379ae343dade5dcebfb86ee10
SHA1

1c47eade3c60ac54cbc1469907b8cb66b9360eec
SHA256

663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484
SHA512

17931a1d179552d4d4028e713da10a984c9ce22d0264ffe03d7a656d90e75b737d1551d2f907d1cade10879f1878cf953b03f3e8659a66108b324df83b085904
SSDEEP

768:raseLAvJ6W7m0OrL75vLzZoFvXcJzYcHeImT:raHLAvJ6W7mV9CZXcYIo

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Windows\\services.exe"	663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\services.exe	663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe
File created	C:\Windows\services.exe	663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
968	663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe
968	663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe

C:\Users\Admin\AppData\Local\Temp\663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe
"C:\Users\Admin\AppData\Local\Temp\663ef55cae9f09f40f887f874bcf86f482a1f60e93f043c5f94864dfaf0a7484.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/968-55-0x0000000074190000-0x000000007473B000-memory.dmp

Filesize
5.7MB

Download
memory/968-56-0x0000000074190000-0x000000007473B000-memory.dmp

Filesize
5.7MB

Download
memory/968-57-0x0000000000729000-0x000000000073A000-memory.dmp

Filesize
68KB

Download
memory/968-58-0x0000000000729000-0x000000000073A000-memory.dmp

Filesize
68KB

Download
memory/968-59-0x0000000074190000-0x000000007473B000-memory.dmp

Filesize
5.7MB

Download
memory/968-60-0x0000000000729000-0x000000000073A000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads