3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9

Analysis

max time kernel
127s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08/01/2023, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9.exe
Size

918KB
MD5

3a9affc5da1f76ad7c8b1b60362f87a4
SHA1

081e10a8a3e5ec115fb07ba53576c04df5e82d2e
SHA256

3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9
SHA512

bde9e552e6777887cce9ddc292787f2815cc69884aac8842987b38d35c708b12567a4249eb36f1bc0f5ea489774e90f6f70c486132796112ba45ea270748182b
SSDEEP

24576:aJlh9bD8RoYybl45/ReD4cFKQ8NJoBD+c8cs7UKvm:aJiTybi/6oQWoBDR+K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
832	3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
832	3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9.exe
832	3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9.exe

C:\Users\Admin\AppData\Local\Temp\3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9.exe
"C:\Users\Admin\AppData\Local\Temp\3fc612bb9249df71f18c3b2748513d862c11d7c45f2a37b003350f8c826921c9.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download