Analysis
- max time kernel
153s - max time network
117s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/09/2021, 13:50
Static task
static1
Behavioral task
behavioral1
Sample
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe
- Size 157KB
- Sample210906-q5dtysbbf9
- SHA256 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42
- MD5 94f7c4c80eb1723977b6f31dbb0f1b3e
- SHA1 a335b3ede802fdb1971b27eb1b3f0996e30237ab
- SHA512 a25788f6ad990a6c9ae1b0f36a07849e9aadb8283fe5e2385f4686f6d7a3f459c0162c09ce5ff2e831202fc8995143b5cf5f5597d249a3b78afa84a96702e347
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 664 wrote to memory of 1960 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 75 PID 664 wrote to memory of 1960 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 75 PID 664 wrote to memory of 1960 664 956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe"C:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe"1⤵
- Modifies Internet Explorer Protected Mode
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exeC:\Users\Admin\AppData\Local\Temp\956bf1e9f894c0ec5e25bcb7d02273d968620fef9916428760e1feb579b23a42.exe --vwxyz2⤵PID:1960
-