17ae41e1fde622159bcfd56e80ce0cdee5edfc147370e77091f17eed192d54e0

General

Target
17ae41e1fde622159bcfd56e80ce0cdee5edfc147370e77091f17eed192d54e0.exe
Size 1.3MB
Sample201109-93gx4stsms
SHA256 17ae41e1fde622159bcfd56e80ce0cdee5edfc147370e77091f17eed192d54e0
MD5 6870fc8181ffe34d34aec5bc9da5796d
SHA1 ccd75faff7c762b8de2ea1d1bd248905c6079ea0
SHA512 e00459a955146446eeec077de2ad38fe58a4a173ee745d5d24bb7fd12d74a68cc51edfb0e8c2d2448c7fcacdcea5755c27b78eac74eb8a0c7c5753eb8d3bf897
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
2564	Windows Defender.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	Windows Defender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Protection = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender.exe"	Windows Defender.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 3124	2564	Windows Defender.exe	77

Program crash 1 IoCs

pid	pid_target	Process	procid_target
184	3124	WerFault.exe	77

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings	17ae41e1fde622159bcfd56e80ce0cdee5edfc147370e77091f17eed192d54e0.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	OpenWith.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2564	648	17ae41e1fde622159bcfd56e80ce0cdee5edfc147370e77091f17eed192d54e0.exe	75
PID 648 wrote to memory of 2564	648	17ae41e1fde622159bcfd56e80ce0cdee5edfc147370e77091f17eed192d54e0.exe	75
PID 648 wrote to memory of 2564	648	17ae41e1fde622159bcfd56e80ce0cdee5edfc147370e77091f17eed192d54e0.exe	75
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77
PID 2564 wrote to memory of 3124	2564	Windows Defender.exe	77