eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33

Analysis

max time kernel
109s
max time network
148s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe
Size

256KB
MD5

82b64d51b7045c19b394c6ff9b3063f6
SHA1

8fdbe0bdc2ce4bf4774b0197bdc361647dbe96e4
SHA256

eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33
SHA512

c0daf112f38216c4789b80bbdb161b14d70e769c31bad7e20f0cf396a8f55590c6044f5ed7626d00f783775649592e4bb9415ca5ad7369597ec6579586259dda
SSDEEP

6144:Votdk4t8BtqheJuEU/Z5XW/96HKwvTv77J:VALOBteeRU/zsUHf

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\test.log	eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1728	eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe
1728	eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe
1728	eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe
1728	eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe

C:\Users\Admin\AppData\Local\Temp\eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe
"C:\Users\Admin\AppData\Local\Temp\eeca028f735f88a584c1f87a7147f74bf4be626f133a8c51eb2423d1f887ab33.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download