Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe
Resource
win10v2004-20220812-en
General
-
Target
595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe
-
Size
7.0MB
-
MD5
4021093dec8e915568683b65fb1efe35
-
SHA1
0e504acdab5832c3f0f5727251a75b335bcfba10
-
SHA256
595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80
-
SHA512
d6b365718b0a7c215d66e20fe8f52782c2a64790797ad050470ef77fc683cac206be4a478b66b51149bf5e32b89401957d0dd2e6d8df0cb2c36e49ac156ce0cc
-
SSDEEP
98304:jAnqyhxd9JJzZbG+Rsvk9KorMQUwzQtmYFMJ0NgjrCFipVQp6P54gkceV1:jAqc9JJ1bPavjwxzQtmYFMJ0NnFipdRU
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3172 595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe 3172 595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe 3172 595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe 3172 595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3172 595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe 3172 595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe 3172 595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe"C:\Users\Admin\AppData\Local\Temp\595b0c44fb779e427d4d281346f903f74fb0148292e23d81c3bc20e20c80eb80.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3172