Analysis
-
max time kernel
135s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 05:24
Static task
static1
Behavioral task
behavioral1
Sample
b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe
-
Size
315KB
-
MD5
4b50aeb3c1215b2d9495656e33eea590
-
SHA1
451ac80458283f6799f23d6d24614bddcc9ff48f
-
SHA256
b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd
-
SHA512
490026012c299b0d675705f3fb59bbd242393ae51f165f3e841e56efb77c4f155fc75cb861a2637d268f77157207afd2f3e7304ff358a2e5cc2b963ae2e5c153
-
SSDEEP
6144:qXDXL0BvnjbJDB7VHMkzQB9qnxc4+/3Rn:0b0BPjb37ykeuxc4M
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\360Safe.ico b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe File created C:\Program Files (x86)\Common Files\System\360Sd.ico b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4556 b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe 4556 b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe 4556 b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe 4556 b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe"C:\Users\Admin\AppData\Local\Temp\b7c60dfa0241d7fb4bd3fe5b828a6b680e5a77093d881b95867a1e448a16aecd.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4556