Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2022 20:29
Static task
static1
Behavioral task
behavioral1
Sample
ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe
Resource
win10v2004-20220812-en
General
-
Target
ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe
-
Size
3.6MB
-
MD5
cf322b2e639c1d0782725650eea90151
-
SHA1
914266d7c231e73ef365ee67a4cee74229b9128d
-
SHA256
ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a
-
SHA512
fec2197136ae72727e56005ff4d0f8bdf7b8cafd6ff7681581b3a3cf173aa65aae11b2a778d1fa637ca5920f8f8569a213aa8636ffaabeadb20dcb27e7676c74
-
SSDEEP
98304:HMc+LUMp8hgbVvLaeP252gHSmfvakPodrB1XaPg8Y+K6g/KP7J:HtkUJktLae+52kSLd1AFY+KI
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 38 IoCs
pid Process 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe 4940 ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe"C:\Users\Admin\AppData\Local\Temp\ffd027e9ee6351c269fe8d0a02b8fe096a7fb04f5d5e098dea8403cbdaafbc9a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4940