148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2022, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Size

44KB
MD5

e4700aa529a7691604cdc5d812ace2d2
SHA1

2ab4d1c56261fd2f4f11871ad293d1af295db7e2
SHA256

148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e
SHA512

e0a9c838e47bab3cd837201b0018acb4e1fe6d797aef0f65bc4ead59a41144e4925513b39bc92cd8ada93bca1e7e42d92ffe54649b87b2a89811996ba9ddd4c2
SSDEEP

384:PYuqL8P78m0+4eYDAnRkS+03U3RPIyhXXZ4VtB+jboDYb:fP78m0peYMRkF03U39XZaB+j8Y

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document\ = "Tencent QQGame Five Recorder"	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Five.exe,-128"	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document\shell	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Five.exe \"%1\""	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.qfs	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.qfs\ = "Five.Document"	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document\DefaultIcon	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document\shell\open\command	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Five.Document\shell\open	148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe

C:\Users\Admin\AppData\Local\Temp\148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe
"C:\Users\Admin\AppData\Local\Temp\148e52ff6fc53a1654e0285f5c2fad00b0c43f764c5829c399fac8c2d370d68e.exe"
1⤵
- Modifies registry class
PID:4100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4100-132-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4100-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads