6c4d098fb1a91f32fa57c2a46b009022a2ad5d0e2c506fb1c4ce97e252437a86

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b1fcc4c5ce65e3cccf10b80df87d985.exe
Size

195KB
MD5

7b1fcc4c5ce65e3cccf10b80df87d985
SHA1

2f8a79f43612703c503a19133429f733ddaee120
SHA256

6c4d098fb1a91f32fa57c2a46b009022a2ad5d0e2c506fb1c4ce97e252437a86
SHA512

069bf782af7d90a158e11ea8159cb05b400e600710f93fc939f12eb157bba25d271eee22f16495924b662ed13d223615c55a79ed5a6b4a47f95e372b1d78c29c
SSDEEP

6144:4k9P2y7bGpKc3q8rk0GqscrfQtolesI4zA:4k1cRzs0OxsJM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	7b1fcc4c5ce65e3cccf10b80df87d985.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	7b1fcc4c5ce65e3cccf10b80df87d985.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3040	7b1fcc4c5ce65e3cccf10b80df87d985.exe
3040	7b1fcc4c5ce65e3cccf10b80df87d985.exe

C:\Users\Admin\AppData\Local\Temp\7b1fcc4c5ce65e3cccf10b80df87d985.exe
"C:\Users\Admin\AppData\Local\Temp\7b1fcc4c5ce65e3cccf10b80df87d985.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download