Resubmissions
05/05/2021, 16:30
210505-lda1w1hczj 105/05/2021, 15:22
210505-prcssfb9m6 101/05/2021, 12:52
210501-l7d8w6sgc6 1Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
01/05/2021, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
Resource
win10v20210408
General
-
Target
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe
-
Size
19KB
-
MD5
5aac519e51e8d443bd6d50d8f4221ea0
-
SHA1
2649e34827acbdd93913b39ab35011fab2830233
-
SHA256
dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42
-
SHA512
9582fc5a96d696652064a831f7fe0296c36210fb34ca946182cddbbe4b95ea37ad18a8870283f7289e527ecaba04a736a93c1e0afd113b3ceb974a3192ce4bd2
Malware Config
Signatures
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3692 OpenWith.exe 3692 OpenWith.exe 3692 OpenWith.exe 3692 OpenWith.exe 3692 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\dd3d5489685e66249cacf412674d950efa255deac5808f1773bb0aeac0be9d42.bin.sample.exe"1⤵PID:632
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3692