995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a

Analysis

max time kernel
141s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06-03-2023 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe
Size

171KB
MD5

a48f7861414cf8b85aeea8175ae7cc8b
SHA1

009d03cba112640b42e2931a3124d258fba255fc
SHA256

995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a
SHA512

f06c817b260db33e68307b2dac24c7a2791c69903d5abfedf1033f525c305c9942d76566777e63735b74e3a50ffbe2fe6e35aeca913b11575588793c8c94e5c2
SSDEEP

3072:Aa9Jt3huaGRXw6wMzt/fZfLRFTyd4UWKGlE9N7o+sQR8+tz3Mcc79Z/x:AaREC1M9NLBUfB7oT+tz1c79R

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe

pid process

1300 995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe

pid	process
1300	995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe
1300	995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe

C:\Users\Admin\AppData\Local\Temp\995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe
"C:\Users\Admin\AppData\Local\Temp\995ec6cfca47db95ef1f253fb19ed72e1836995067bacda0c3247bec5d6e2c0a.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1300

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-55-0x00000000003C0000-0x000000000043F000-memory.dmp

Filesize
508KB

Download
memory/1300-54-0x00000000003C0000-0x000000000043F000-memory.dmp

Filesize
508KB

Download
memory/1300-56-0x00000000003C0000-0x000000000043F000-memory.dmp

Filesize
508KB

Download
memory/1300-57-0x00000000003C0000-0x000000000043F000-memory.dmp

Filesize
508KB

Download