6b6845589633216be83bc88cb8327123eaf9b1afc63615afd95aa4d03d11c920

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 11:45 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97138ca59fb5d0e4743a9b4b13544aff.exe
Size

830KB
MD5

97138ca59fb5d0e4743a9b4b13544aff
SHA1

c48ebbec7f8300c23107e4925ccb1e82d0ab8560
SHA256

6b6845589633216be83bc88cb8327123eaf9b1afc63615afd95aa4d03d11c920
SHA512

8013c372b35a02fe8fa8745ab63cdebe6f02de0beff54016bdb62881add8be7eba076df2ec5e47f5b698ccc15ac464063e6c0b62f8bbd9603200521db2a9d793
SSDEEP

24576:DIwrd1ChRW93Lh8AkM4kb5L7QNU38fhWoWXjz98yF:DI+d4yNhIYuusfYo2NB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	97138ca59fb5d0e4743a9b4b13544aff.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1044	97138ca59fb5d0e4743a9b4b13544aff.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1044	97138ca59fb5d0e4743a9b4b13544aff.exe
1044	97138ca59fb5d0e4743a9b4b13544aff.exe

C:\Users\Admin\AppData\Local\Temp\97138ca59fb5d0e4743a9b4b13544aff.exe
"C:\Users\Admin\AppData\Local\Temp\97138ca59fb5d0e4743a9b4b13544aff.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-9-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download