64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2 | Triage™

Analysis

max time kernel
116s
max time network
115s
platform
windows10_x64
resource
win10
submitted
13/07/2020, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe
Size 517KB
Sample200713-ctdf6rnhee
SHA256 64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2
MD5 701933d4005fb08410ce6d9be97cf849
SHA1 3ec09a05f7a56c85243fe9d71a072e61e92792e0
SHA512 ab74b3cb2f509c1a0849ec88287244533c536c89a5d0c91ee4fdf15642c86c4f33956dd2d3f9cfae2a5dd45c050dfae0bf27d78620136074aa9a6b8580c0dc21
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3588	64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe
3588	64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3588	64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe

C:\Users\Admin\AppData\Local\Temp\64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe
"C:\Users\Admin\AppData\Local\Temp\64318f762d0bd8ed0606af0b7d5324b12bb38f0e88dd565bd93e9c0bfa8a34c2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: GetForegroundWindowSpam
- Modifies registry class
PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads