fd0bd4d92cc8d45075c0a665777dfb819633b36d18b5e089f61be35d5ab80c4b

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 04:23 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

100KB
MD5

dcc15ed3f9d9a5f1874e1243ac81d425
SHA1

3b380eea0a4d5bec1562d65a4b1e6e7b198afad5
SHA256

fd0bd4d92cc8d45075c0a665777dfb819633b36d18b5e089f61be35d5ab80c4b
SHA512

189cbfd47b1e40c924d113b3250f2be59dd16cad42d54db04972dd748418d425fab548a26ce860095628fc74c97ae478c40feca05d16ec62ec7847bbec805faa
SSDEEP

1536:Ut/U8w8wXDc3e5Dh6/kVkeoUv2W9UJ6zBh5WKEOw9nFsuUr7ukJ538ig2HBnN:UtFw8wzBh6/WBUJ0T5mLUryk78ig2Hb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main	tmp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1852	tmp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1852	tmp.exe
1852	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.