Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-05-2021 03:55
Static task
static1
Behavioral task
behavioral1
Sample
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe
Resource
win10v20210410
General
-
Target
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe
-
Size
220KB
-
MD5
b7dd0435cfd59929fb75c522f1b1e838
-
SHA1
19ec6983a31b1d1b81352223815c0511b70ba2fa
-
SHA256
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482
-
SHA512
211269f58bff0da41d6d24af4391569baa323d80e2ab76479f45061937e2ab52d8c08bfe0be0852b83f51ef47866ee3a9815ca4c76d595363263a7918f7527c5
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exepid process 2256 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exepid process 2256 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exepid process 2256 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe 2256 50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe"C:\Users\Admin\AppData\Local\Temp\50b45cd978c8c6cdd63edbf37fd9bc66cd12cca2ef264a5b2968618cace20482.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx