e423e6bb96439a76e88974467209e5c02eb7e46f237c301a22473232742cd9b8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SEO助手.exe
Size

324KB
MD5

99bb010ee995d8c158dcb25144818f02
SHA1

fac1bca97262a174b234124b1ddf60d5452ed5cc
SHA256

8807fcdfabe295d594bd4bca64a2cd2c2b3aac23262e7d01693ef034b36708bf
SHA512

27e70a6fb03dc5df114692eeb9e271f5939c35705bd0319304ea5c53fc94e68cdaa24b8e9e7ad91cfa87e76d9145c58b0cc72ecbf9ef9fb48278839fd44bc42b
SSDEEP

6144:MhrB4d7zSkivYMOa6+NfxaMaRaUasqaMayaqaMaMaMa5a:5AYxwNfxxI3bqx5ZxxxE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	SEO助手.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2148	SEO助手.exe
2148	SEO助手.exe

C:\Users\Admin\AppData\Local\Temp\SEO助手.exe
"C:\Users\Admin\AppData\Local\Temp\SEO助手.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2148-2-0x0000000001E20000-0x0000000001EA0000-memory.dmp

Filesize
512KB

Download
memory/2148-1-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-3-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2148-4-0x0000000001E20000-0x0000000001EA0000-memory.dmp

Filesize
512KB

Download
memory/2148-5-0x0000000001E20000-0x0000000001EA0000-memory.dmp

Filesize
512KB

Download
memory/2148-6-0x0000000001E20000-0x0000000001EA0000-memory.dmp

Filesize
512KB

Download
memory/2148-16-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download