0b023c957c1e1db10f3286b2efd2e99c6bd42fdafd9c62c5da79eb0e0cf799eb

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

750f78f314b38d16c01d3311188ed632.exe
Size

135KB
MD5

750f78f314b38d16c01d3311188ed632
SHA1

1d9a0a9820659e42f02ef33a65dddef64829a8d3
SHA256

0b023c957c1e1db10f3286b2efd2e99c6bd42fdafd9c62c5da79eb0e0cf799eb
SHA512

de8e93253ad739a37b3ccecd825869d9537a2664c1df183f7cf90614b011ed4100de3a7808708acbba362d73ef77df97cb03d7b3eb831685b5f3d48f6005637f
SSDEEP

3072:kWDdpkGLGqEIYebgLBHFTmrnb5qaMHjfEjhACSaU6DFUQc9xTaU:kWfLLGq9YebsRmrYaMzEjhtS8pNeOU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

750f78f314b38d16c01d3311188ed632.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	750f78f314b38d16c01d3311188ed632.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

750f78f314b38d16c01d3311188ed632.exe

pid process

2040 750f78f314b38d16c01d3311188ed632.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

750f78f314b38d16c01d3311188ed632.exe

pid process

2040 750f78f314b38d16c01d3311188ed632.exe
2040 750f78f314b38d16c01d3311188ed632.exe

pid	process
2040	750f78f314b38d16c01d3311188ed632.exe

pid	process
2040	750f78f314b38d16c01d3311188ed632.exe
2040	750f78f314b38d16c01d3311188ed632.exe

C:\Users\Admin\AppData\Local\Temp\750f78f314b38d16c01d3311188ed632.exe
"C:\Users\Admin\AppData\Local\Temp\750f78f314b38d16c01d3311188ed632.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2040

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-9-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download