Overview
overview
10Static
static
10out0.exe
windows7-x64
1out0.exe
windows10-2004-x64
1out1.exe
windows7-x64
1out1.exe
windows10-2004-x64
1out10.exe
windows7-x64
1out10.exe
windows10-2004-x64
1out11.exe
windows7-x64
1out11.exe
windows10-2004-x64
1out12.exe
windows7-x64
1out12.exe
windows10-2004-x64
1out13.exe
windows7-x64
1out13.exe
windows10-2004-x64
1out14.exe
windows7-x64
1out14.exe
windows10-2004-x64
1out15.exe
windows7-x64
1out15.exe
windows10-2004-x64
1out16.exe
windows7-x64
1out16.exe
windows10-2004-x64
1out17.exe
windows7-x64
1out17.exe
windows10-2004-x64
1out18.exe
windows7-x64
1out18.exe
windows10-2004-x64
1out19.exe
windows7-x64
out19.exe
windows10-2004-x64
out2.exe
windows7-x64
1out2.exe
windows10-2004-x64
1out20.exe
windows7-x64
1out20.exe
windows10-2004-x64
1out21.exe
windows7-x64
1out21.exe
windows10-2004-x64
1out22.exe
windows7-x64
1out22.exe
windows10-2004-x64
1Analysis
-
max time kernel
173s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2022 01:10
Behavioral task
behavioral1
Sample
out0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
out0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
out1.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
out1.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
out10.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
out10.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
out11.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
out11.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
out12.exe
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
out12.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
out13.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
out13.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
out14.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
out14.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
out15.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
out15.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
out16.exe
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
out16.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
out17.exe
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
out17.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
out18.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
out18.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
out19.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
out19.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
out2.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
out2.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
out20.exe
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
out20.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
out21.exe
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
out21.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
out22.exe
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
out22.exe
Resource
win10v2004-20220901-en
General
-
Target
out11.exe
-
Size
72KB
-
MD5
a922e4039818351e464a06e79db997c5
-
SHA1
e6c70ef25a39195c9fda844ab6edbb52ea52f5a9
-
SHA256
2bca8171c2d97fcc5275108af744833c5d8899f7527267f45b4f38bcf3fb3348
-
SHA512
5f0ce13b517e5fdd625daae1ecb4f9a8108062bd6feddb606052dea39bec1618d2ee388ab859428ef2d503a677f1b3c1fbb5be02fdd0607cdb4ed567cc97e0bf
-
SSDEEP
1536:ID/OprztSxNvfSae3QL4Mb+KR0Nc8QsJq39:6/O7SzSF3I4e0Nc8QsC9
Malware Config
Signatures
-
Modifies registry class 1 IoCs
Processes:
calc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings calc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4000 OpenWith.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
out11.exedescription pid process target process PID 1988 wrote to memory of 1256 1988 out11.exe calc.exe PID 1988 wrote to memory of 1256 1988 out11.exe calc.exe PID 1988 wrote to memory of 1256 1988 out11.exe calc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\out11.exe"C:\Users\Admin\AppData\Local\Temp\out11.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\calc.execalc.exe2⤵
- Modifies registry class
PID:1256
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4000