dc8c5a2274a172a5d0beb4d3af8589a0dd02814240bf06c150264ca2f6405a6d

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f65b513e3dfaeb0c049c716552c9ae8.exe
Size

244KB
MD5

0f65b513e3dfaeb0c049c716552c9ae8
SHA1

363f93c3fc382a163a20861d48e55d9a4a72371b
SHA256

dc8c5a2274a172a5d0beb4d3af8589a0dd02814240bf06c150264ca2f6405a6d
SHA512

98601d39d993b6ace760708bf9dd56a08e1ec3f31bae8f0f4562f7550e56ea01eb02c297bcc1d9d19f16352ac49a07a66cc7139e7a61399865185600cf9d0c4c
SSDEEP

6144:xME1nmg1tDbJ5621YNSsdxVQMcOCVTRe5hsY+k+mk:egnJT2jhsltv

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	0f65b513e3dfaeb0c049c716552c9ae8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1700	0f65b513e3dfaeb0c049c716552c9ae8.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1700	0f65b513e3dfaeb0c049c716552c9ae8.exe
1700	0f65b513e3dfaeb0c049c716552c9ae8.exe

C:\Users\Admin\AppData\Local\Temp\0f65b513e3dfaeb0c049c716552c9ae8.exe
"C:\Users\Admin\AppData\Local\Temp\0f65b513e3dfaeb0c049c716552c9ae8.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download