ddbb80808113c6f4d328ebf1fb82dfdadd5aed0e99e81b87c5354672e09e49f3

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ct_3_1_win_installer.exe
Size

716KB
MD5

d483ff45240d9b0988b23711342ef126
SHA1

064b2f0e7e3bfc6ad04c2d483182af0620183380
SHA256

ddbb80808113c6f4d328ebf1fb82dfdadd5aed0e99e81b87c5354672e09e49f3
SHA512

cd624fd9aa0aef2055e96562c13607cd661103f76b57735c58674940c19a1eaf3fc8cb8d7931bd70173c6d9ca8c346661d6ad90f4cfd3fc6cbfe79262b012158
SSDEEP

12288:QgnJkPOUr6le9ASmsIT7JWXHGG3SPYhxx3E4GTOfZUbdWtkoChKRXB1t:ZnJqullyIRW9Phr3MRWKhA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ct_3_1_win_installer.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	ct_3_1_win_installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ct_3_1_win_installer.exe

pid	Process
2624	ct_3_1_win_installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ct_3_1_win_installer.exe

pid	Process
2624	ct_3_1_win_installer.exe
2624	ct_3_1_win_installer.exe

C:\Users\Admin\AppData\Local\Temp\ct_3_1_win_installer.exe
"C:\Users\Admin\AppData\Local\Temp\ct_3_1_win_installer.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2624-13-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download