419739f56effb76add07f0a9abb0e4270fcb75509ae59b7f13043bc10e7aaff4

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

caf183dade288546ebb89e0510ab6a45.exe
Size

3.5MB
MD5

caf183dade288546ebb89e0510ab6a45
SHA1

1b093244a6791f25791e299042b062cd0e41a3b7
SHA256

419739f56effb76add07f0a9abb0e4270fcb75509ae59b7f13043bc10e7aaff4
SHA512

9607768e9c5f6e5f9be74470bc63c307e17d2c1fd388d7e69da8e73e38f8867b5dbaa7b896c0cd0de7e4082db48c4049f0f9ed61438c6866755ec0a900beef3c
SSDEEP

98304:0Y0xGQCbqws+ERhx8dztks2+1f8Bmxj1c:0YhqeERkptkHm2m51c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	caf183dade288546ebb89e0510ab6a45.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1848	caf183dade288546ebb89e0510ab6a45.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1848	caf183dade288546ebb89e0510ab6a45.exe
1848	caf183dade288546ebb89e0510ab6a45.exe

C:\Users\Admin\AppData\Local\Temp\caf183dade288546ebb89e0510ab6a45.exe
"C:\Users\Admin\AppData\Local\Temp\caf183dade288546ebb89e0510ab6a45.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-9-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download