969afdddc6badf273d0857510b14403072ea64836a0a71256970f92a4bcd3353

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

G-ForceToolbarRU.exe
Size

370KB
MD5

c287f007b31e54641b6c9048a2da0a8f
SHA1

5be4fa3cc596bd48cec85a874f9a78a716003999
SHA256

969afdddc6badf273d0857510b14403072ea64836a0a71256970f92a4bcd3353
SHA512

361ade37e1177760516276644b9de43d2e82b641d25813ae851ed3d38e8d7af8f213dd6382bd8a265cd95de22988d5d2212c9383ebb33991e0b9eee4a7022119
SSDEEP

6144:Ta3f8Yb0u86b+3qS4l2IAi5M4raReNmrM7/Bi9kHvQ/lBZwE4ps4jvrl:Tav8hD+tdXlraRNY7/A9kHY/lHz4e4jR

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	G-ForceToolbarRU.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2956	G-ForceToolbarRU.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2956	G-ForceToolbarRU.exe
2956	G-ForceToolbarRU.exe

C:\Users\Admin\AppData\Local\Temp\G-ForceToolbarRU.exe
"C:\Users\Admin\AppData\Local\Temp\G-ForceToolbarRU.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-15-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download