e06f76599cb5c522b9e739db71afd98be6d77807a5eeb610dfa12c16730b7e14

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A.exe
Size

76KB
MD5

ef04d5487b1a45b29054fa5214714e2b
SHA1

dcda5360be950103f43d71e4668f0db2cac76e1e
SHA256

e2b0dd06b53e6485a9647ff2ff00e6788b1e8ab38eaa62c1ef7c518e92351a73
SHA512

73b8f9d8f9e4f9fd20dbfdfa20e073308ae9bbd2ac2ac677b44e059d625d40b0af264fed4fba3e0727195a0762c7e183bf1111dcde590fc3a8c688bdc52d1ac1
SSDEEP

768:AsizDPjHibDEYIYWtnPWYwQ4ouhG+dKYFf9Ql5UVeTVBxVmVjGHdZwRsL3eOZVPt:5oFH9/w22rN2tVBx8pyL3HZVPwFi+py

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	A.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	A.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2040	A.exe
2040	A.exe

C:\Users\Admin\AppData\Local\Temp\A.exe
"C:\Users\Admin\AppData\Local\Temp\A.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download