Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-06-2021 17:25
Behavioral task
behavioral1
Sample
b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe
-
Size
154KB
-
MD5
9231b4b9928daee89b5e510c07263960
-
SHA1
21cb38c8b351fbc99a6dda2109d2647d91009788
-
SHA256
b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9
-
SHA512
7919201424fb5b8c72f3d718382164000536bbc82f7f9b209d98ce776439ef408156ec073632abae3afbb982384684812dd62acc1f2b8202ad0321ee09717e8c
Score
1/10
Malware Config
Signatures
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4060 wrote to memory of 2184 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 74 PID 4060 wrote to memory of 2184 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 74 PID 4060 wrote to memory of 2184 4060 b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe"C:\Users\Admin\AppData\Local\Temp\b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exeC:\Users\Admin\AppData\Local\Temp\b264f7ef3b25b411f123a7c30c9c06a69632e45ab6e31eaec92f2975c63345f9.exe --vwxyz2⤵PID:2184
-