Analysis
-
max time kernel
69s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 22:07
Static task
static1
Behavioral task
behavioral1
Sample
bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe
Resource
win10v2004-20221111-en
General
-
Target
bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe
-
Size
34KB
-
MD5
44d31f4a8d4652558cab8627c8f5626e
-
SHA1
d721f91c0903f71a07c4ff457f640b4463e4e867
-
SHA256
bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b
-
SHA512
6b7367073b3296bd7687598910a40ee4a17c051080c8fb2ed304e7a9a6a7876f3b81efc1a3eb97cd34a0b8bd9232841ada2657a9d2f6018b79955b433186a9c8
-
SSDEEP
768:JwGayxUjJ+oo1pVNJR9S8aAYu40iNMzpu+4+zEui:OGayUjoooBPS8apb+Vz
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\spool\PRTPROCS\x64\xUOCE1a.dll bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe File opened for modification C:\Windows\system32\spool\PRTPROCS\x64\xUOCE1a.dll bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1952 bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1952 bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe"C:\Users\Admin\AppData\Local\Temp\bd069f768ad3192274ce2496c5144cc0b4fbc82037d811c4bd5cb721c151752b.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1952