3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79

Analysis

max time kernel
146s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-02-2023 20:13

Target

3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe
Size

17KB
MD5

e73d503ee469ff08ef988bc82b46e371
SHA1

f287780056292c8aeb31c25508639507c70f2e07
SHA256

3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79
SHA512

076f9176f1445e1a171df9399e1ced65340dbdc8e3ff7e9be122735baf64facb2bd3517cd91978b7b2185a195001e59c261bdfa2c0cd88f37fc16bbe4fba7394
SSDEEP

384:6IlPD40FbMdW4z/vXsgRt0QZE2eWDWxGXAxBr6+I9PfPPD4eKDUKD:64tJMdxMgRqQZE2eWDWxGwxMLfb4

Score

1^/10

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

Processes:

RunDll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RunDll32.exe

pid process

240 RunDll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe

pid process

1388 3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe

pid	process
240	RunDll32.exe

pid	process
1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe

description	pid	process	target process
PID 1388 wrote to memory of 240	1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe	RunDll32.exe
PID 1388 wrote to memory of 240	1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe	RunDll32.exe
PID 1388 wrote to memory of 240	1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe	RunDll32.exe
PID 1388 wrote to memory of 240	1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe	RunDll32.exe
PID 1388 wrote to memory of 240	1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe	RunDll32.exe
PID 1388 wrote to memory of 240	1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe	RunDll32.exe
PID 1388 wrote to memory of 240	1388	3c2c1ce4342b5c679be56b4423e9976c2c26d1b955bd1b33e78715dab8091e79.exe	RunDll32.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/240-58-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1388-54-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1388-57-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download