71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9

Analysis

max time kernel
64s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Size

730KB
MD5

2a330f9e82e33acd121d589220aa2391
SHA1

2ab2cbe731eab59c26484b35dd16ba0165b1a54a
SHA256

71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9
SHA512

94820356cd70583147fb33dc961d586cbb5b43f22d9fe9885e9a3e90dfd375a990b558531584f9d51d8f744c169b334b17e4ccbf249287510e162233dee18f7a
SSDEEP

12288:KbVm1buEPKv+kn8bQE3LK7M9Cf0KDjiGsgbx6UWfdqf4hUy:Kgwn8bQSK7M9CfgGDx6ZfM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.senstong.com\ = "63"	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\senstong.com\Total = "63"	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DOMStorage\senstong.com	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\senstong.com	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\senstong.com\NumberOfSubdomains = "1"	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.senstong.com	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3348	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
3348	71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe

C:\Users\Admin\AppData\Local\Temp\71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe
"C:\Users\Admin\AppData\Local\Temp\71b0752b0399c442205ec7689423ac3300e379ce6d0fcea923b9f31ad191f3c9.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3348-132-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/3348-133-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/3348-134-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/3348-135-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/3348-136-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download