76c8ba36ec88d966a5a9f6aa04eb76d0dd906b7a9192d6159884bae644a1ddc3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ea24e2858c44d156ff231070f7167c.exe
Size

643KB
MD5

63ea24e2858c44d156ff231070f7167c
SHA1

681ae0e402a8b39f0e6b852f873028eec126c34d
SHA256

76c8ba36ec88d966a5a9f6aa04eb76d0dd906b7a9192d6159884bae644a1ddc3
SHA512

5959186b53cd681808ab5a8eaa78e75679eb528888bce41220685c586f8c89b6f727bfa789e3e8931b72afbb6cb7300577a685ae149677029d9fc7b59aed1048
SSDEEP

12288:Nr/ppkkACNSNy5FUpHrhkBdOyUrAyWx0f8ZJpQ:NjnANy5IHNgisx0fE

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	63ea24e2858c44d156ff231070f7167c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2052	63ea24e2858c44d156ff231070f7167c.exe
2052	63ea24e2858c44d156ff231070f7167c.exe

C:\Users\Admin\AppData\Local\Temp\63ea24e2858c44d156ff231070f7167c.exe
"C:\Users\Admin\AppData\Local\Temp\63ea24e2858c44d156ff231070f7167c.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2052-1-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2052-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2052-5-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download