Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 23:36
Static task
static1
Behavioral task
behavioral1
Sample
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe
-
Size
228KB
-
MD5
af75dbe29d53a6872358df9798dab0e4
-
SHA1
19e95c020e4595eb6467445e83e1521ac333209e
-
SHA256
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb
-
SHA512
7a1eb662a286bcbef5de6a3327d24b4a0fd10096e62ac4b7e0882389ea2396929a143c2e2b82fe7aba5d4da9f513cbce33207940d45441a4113aea00929c94e1
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VLXHCMT5KJ = "C:\\Users\\Admin\\AppData\\Roaming\\AG58FPQON.exe" 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exepid process 3584 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exepid process 3584 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe 3584 433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe"C:\Users\Admin\AppData\Local\Temp\433859412cbe1896a252752e5c8f0b5dd27b085b84c8db723b879b41bbe639fb.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3584-130-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB