Overview

overview

4

Static

static

ed14687085...bd.exe

windows7_x64

4

ed14687085...bd.exe

windows10_x64

4

Resubmissions

29/10/2021, 07:54

211029-jrj1gschc3 4

29/10/2021, 07:48

211029-jnellahfbl 4

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    29/10/2021, 07:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe

  • Size

    297KB

  • MD5

    ebc2661a409a3a743bba237ba1bfc4e8

  • SHA1

    1d9052ce97f4f127f2626b2ff2ee106b4f8b9a70

  • SHA256

    ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd

  • SHA512

    c7999fa0449fd98bd4869327189688942d3812d2d127d4e34173194af11dc2436dcd8a3fef025f5c6075372e0bccf45b859a5d2559d71c100f3281046d0ab1a6

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe
    "C:\Users\Admin\AppData\Local\Temp\ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2704
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3888
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
        "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Documents\HideDeny.rtf.fmiint-sqnsxris"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:4036

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads