Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-06-2021 20:45
Behavioral task
behavioral1
Sample
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe
-
Size
157KB
-
MD5
94f7c4c80eb1723977b6f31dbb0f1b3e
-
SHA1
a335b3ede802fdb1971b27eb1b3f0996e30237ab
-
SHA256
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42
-
SHA512
a25788f6ad990a6c9ae1b0f36a07849e9aadb8283fe5e2385f4686f6d7a3f459c0162c09ce5ff2e831202fc8995143b5cf5f5597d249a3b78afa84a96702e347
Score
1/10
Malware Config
Signatures
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
Processes:
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exepid Process 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exedescription pid Process procid_target PID 1988 wrote to memory of 1000 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 28 PID 1988 wrote to memory of 1000 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 28 PID 1988 wrote to memory of 1000 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 28 PID 1988 wrote to memory of 1000 1988 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe"C:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exeC:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe --vwxyz2⤵PID:1000
-