Analysis
- max time kernel
20s - max time network
147s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe
- Size 2.8MB
- Sample201109-zykmmvacjj
- SHA256 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d
- MD5 fb0fdda96643cc43b705e58deaa1bde3
- SHA1 b88fa8be0c5137194611e0a3471b6da9020053ff
- SHA512 2d94e4e94efbf89504644293abc0d5c9e47870174471d4be1051c52a7a90886892a9dfa0c950c773e70cccc7ad7005cc99e57c8accf3a10aac9146457e663377
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "51" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "73" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "65" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "40" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "48" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\NumberOfSubdomains = "1" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "65" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "65" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "62" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "51" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "48" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "78" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "78" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "51" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "73" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "40" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.baidu.com\ = "62" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\baidu.com\Total = "62" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "40" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "73" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "78" 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1036 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe 1036 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe 1036 241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe"C:\Users\Admin\AppData\Local\Temp\241625708e891ea948fcb7ce25286ecc4c693416b1348e554f50d1a7eea7375d.exe"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1036