1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2022, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Size

359KB
MD5

466b41653620aebf0ea31eee2779b52b
SHA1

4f13524710914e6df64c8078540fc7985f00fb09
SHA256

1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7
SHA512

2368fb79a4a6b13c79aecfcc7f238b73108837efe8ace4d0474398e0f01f9034081e9c64d43d0a801fc5d6af5ff7c3221fa1aaaef15da54e03328857b67ff32d
SSDEEP

6144:eBfosESuJD5MhiL6w1NQA+Bw9AxYyFpT5j0M0m5Vit0iiOwRRonrvYmEbUr82u:eBfPUJFneSNvle9jtj0M0m5xlkvSI82u

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe"	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.MyNSHandler\ = "this is my ebook"	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}"	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.MyNSHandler"	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook"	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.MyNSHandler	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.MyNSHandler\Clsid	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3124	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
3124	1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe

C:\Users\Admin\AppData\Local\Temp\1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe
"C:\Users\Admin\AppData\Local\Temp\1d7b1acb3bb24cb6f3d2a3f59bde147781e29db948927de5fb4f8c3e4abb2ed7.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3124-132-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3124-133-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads