e9f9bcc06f6cfcecc8006006077c9eb9eb91598eb51eda8029b5031ee2b6c342

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a34a3e9ce06455e5491e1693d3fe12.exe
Size

192KB
MD5

17a34a3e9ce06455e5491e1693d3fe12
SHA1

65a4e19dbb175c2f2deb224e1479e68a45b6eb5d
SHA256

e9f9bcc06f6cfcecc8006006077c9eb9eb91598eb51eda8029b5031ee2b6c342
SHA512

a33e7860ad7de58355192fe9e6c4d32a3ff48726bd89c23a604657ce05434e91b1d47bbcdf4c8d35496771d943d01ddde6f4ecc2c55aa4cc5b1413833a8345e6
SSDEEP

6144:+2Ked8cbc1jEPTYEAJajyszvE7ndmCk7v52D103+pQ:+Od8d1I7Dv4LdmCMv581030Q

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	17a34a3e9ce06455e5491e1693d3fe12.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2068	17a34a3e9ce06455e5491e1693d3fe12.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2068	17a34a3e9ce06455e5491e1693d3fe12.exe
2068	17a34a3e9ce06455e5491e1693d3fe12.exe

C:\Users\Admin\AppData\Local\Temp\17a34a3e9ce06455e5491e1693d3fe12.exe
"C:\Users\Admin\AppData\Local\Temp\17a34a3e9ce06455e5491e1693d3fe12.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download