d1978aa760ffecf4b33c478177524ab708974e81a75a6d2190293162e028da2e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32位内部跑商aA30.1.exe
Size

9.4MB
MD5

8f48e05ed3975163481f40e40909d6fe
SHA1

6e78e357cdf16854ff34f9f89afdc2b8d28b8be5
SHA256

d1978aa760ffecf4b33c478177524ab708974e81a75a6d2190293162e028da2e
SHA512

ffaef589b6c2e39d842fd93ccfe5d0981b3a008e05152fe41cb678da8e44a8c46391d7d3c44d85012730f868a1e492e97378d7b7a089011cd503ca122ae61511
SSDEEP

196608:bCwQxP1LDTQmf65jXoQaRCsOmMRSK0j1NGs5tYt4Te5KWJE:bCP1LDTQmf65jXoA/bxo1AsXTeUWG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	32位内部跑商aA30.1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1028	32位内部跑商aA30.1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1028	32位内部跑商aA30.1.exe
1028	32位内部跑商aA30.1.exe

C:\Users\Admin\AppData\Local\Temp\32位内部跑商aA30.1.exe
"C:\Users\Admin\AppData\Local\Temp\32位内部跑商aA30.1.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...