50ad047c811525ec579f4e8945d910ed19aefb737c11fd896691883f93d60ac4

Analysis

max time kernel
142s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ItsPers/itspers_setup.exe
Size

881KB
MD5

a476d900c91cb4bc69ea501bb12c19c2
SHA1

5cf5a6f952368decba0475ce1ea58d01e5e63ce4
SHA256

c55a576488bbaa8f0ebb24f93325e4763a5ac314f2125d06dbc6946ce623cf1e
SHA512

52552450d3b5c2f8bca91b41e953cfa1da016f42f5af5a76922328799fbc2a22372416f34d80e6c807dc10f8ab37643efe075ed21ed8cbdd3095f6c368795200
SSDEEP

24576:yVBC5dTq2DFs52P396yIUP5tt6PJStwZUg:yVsLTRZnJrPjt6xStwZ3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	itspers_setup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2092	itspers_setup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	itspers_setup.exe
2092	itspers_setup.exe

C:\Users\Admin\AppData\Local\Temp\ItsPers\itspers_setup.exe
"C:\Users\Admin\AppData\Local\Temp\ItsPers\itspers_setup.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download