1786d9bdb752a866bba3beaa27f0b6e635e4c6449bcc32105539551758186492

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AntivirusDefender-main/antivirusfalsepositivetest4/antivirusfalsepositivetest4/Resources/f.exe
Size

3.0MB
MD5

4994952020da28bb0aa023d236a6bf3b
SHA1

af807380a745a4bcf937b87a081ef895ee7f15ba
SHA256

bb8c0e477512adab1db26eb77fe10dadbc5dcbf8e94569061c7199ca4626a420
SHA512

88393499d0816c173ea0b983995833e82e1aac1a73554d0b64d959b69dcf943644ab74927ad576bda48bbdace66256900aab33383f5a0546f6dfe21a8dd5662a
SSDEEP

49152:AVKOBfJXA6rO+24f3TJA5RhU6UK4tNg0ZTw3Km8Igr8bvz1L7lOru5/cTomv/xtI:eKOBfKMO+2wTJA5RMaqk3Km8Igr8r1mq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
624	f.exe
624	f.exe

C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\antivirusfalsepositivetest4\antivirusfalsepositivetest4\Resources\f.exe
"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\antivirusfalsepositivetest4\antivirusfalsepositivetest4\Resources\f.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-0-0x0000000000160000-0x0000000000186000-memory.dmp

Filesize
152KB

Download
memory/624-1-0x0000000000160000-0x0000000000186000-memory.dmp

Filesize
152KB

Download
memory/624-2-0x000000007746F000-0x0000000077470000-memory.dmp

Filesize
4KB

Download
memory/624-3-0x0000000001330000-0x00000000013E7000-memory.dmp

Filesize
732KB

Download
memory/624-4-0x00000000774A8000-0x00000000774A9000-memory.dmp

Filesize
4KB

Download
memory/624-12-0x0000000000160000-0x0000000000186000-memory.dmp

Filesize
152KB

Download
memory/624-13-0x0000000001330000-0x00000000013E7000-memory.dmp

Filesize
732KB

Download