Analysis
-
max time kernel
162s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 06:19
Static task
static1
Behavioral task
behavioral1
Sample
def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe
-
Size
569KB
-
MD5
802d564c270943565360ab3058c6a690
-
SHA1
d8bda2148e740579c96ebe2421b63f5d692c2c1d
-
SHA256
def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918
-
SHA512
a499d4c88ede8491a731860c53922fc1083c29083fec8b6fcbab27cc1cd92faf57e4b7269be1a58cdf155821f23f0ff66a3737b2de5905810f01db91d7cae877
-
SSDEEP
12288:ji8l1vGkvn6WIi9aDhoFPp37jtHslw7QS27dNTac:e8dd6WIioDh+PzMlAuDTv
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sound = "C:\\Windows\\Sound.exe" def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Sound.exe def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe File opened for modification C:\Windows\Sound.exe def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe 3468 def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe"C:\Users\Admin\AppData\Local\Temp\def22cfc787e93dea23b878f6156132c4e2e2d5bf9cd9d806e181cd5c4248918.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3468
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4808