General
-
Target
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.zip
-
Size
28KB
-
Sample
221108-m5zjwaehbp
-
MD5
64e91532b95cc75c4c1dc2fb9a86bdbb
-
SHA1
f99b61a453870a60856d2f6ec6e445166912e730
-
SHA256
289c0f0f4ccee755aaf90a6037743d73d3da2cebc34366679ccc841d5eb5ed58
-
SHA512
da81fb12f6d88b3f07e045f0fd23eb11b9e08c7e06f554c210c4b4089ebcdeb2aae3c98e681a3a044516001ae4cd13edcc9b23af2122f61812c64ba06d9dfb56
-
SSDEEP
768:hd3hAMeZAA8jgtmqdaVfvFC0yBaE6ZzzD5OUGbHuenfC:hd3sZf8sQUaVfkjBaE6tDEUGQ
Behavioral task
behavioral1
Sample
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\1628246561\+README-WARNING+.txt
Targets
-
-
Target
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
-
Size
42KB
-
MD5
5884482db6adca2b8476c395c66805e7
-
SHA1
4c5b8b834d7d9e8b1316a1b8d2e7b9024022d4ce
-
SHA256
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839
-
SHA512
4e1007fb311c474217b8dfb810d04c2b188deadf56dcd81ee532a48abeb5fc29ff0eae7628cda5aa78f690f46c2370dfb3379e270ee03e83025f7a872f99e52d
-
SSDEEP
768:AO1oR/RVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDsUky5DuGMKKz0YnW:AXS1FKnDtkuImNNxFKU
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops file in System32 directory
-