Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 07:55
Static task
static1
Behavioral task
behavioral1
Sample
d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe
Resource
win10v2004-20220812-en
General
-
Target
d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe
-
Size
68KB
-
MD5
6faa2e319a42288353593505a6f99b32
-
SHA1
8a79c335aa6464ae1419c1a4aa00edd3001e1417
-
SHA256
d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a
-
SHA512
992226a0007e4691836eab62f10b77746f0e3562db231cda3a2db1495a08ec04691918f363835419df92eccddf9629cd105e9b0a1cbdc869b336427f925a8572
-
SSDEEP
1536:w/MC6e4ikK4UKgiMqQSEq0+o20Ww2mps:PC6e4ikK4UKgiMqQSEq0+o20Ww23
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created \??\c:\windows\New Folder (2).exe d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe File opened for modification \??\c:\windows\New Folder (2).exe d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1348 d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1348 wrote to memory of 672 1348 d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe 26 PID 1348 wrote to memory of 672 1348 d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe 26 PID 1348 wrote to memory of 672 1348 d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe 26 PID 1348 wrote to memory of 672 1348 d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe"C:\Users\Admin\AppData\Local\Temp\d73a466f3009a9b180baa74e4cf02d9ad1454daa1ee923155a33014bd11aa01a.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\windows\explorer.exec:\windows\explorer.exe2⤵PID:672
-