Analysis
-
max time kernel
160s -
max time network
214s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:47
Static task
static1
Behavioral task
behavioral1
Sample
22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820.exe
Resource
win10v2004-20221111-en
General
-
Target
22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820.exe
-
Size
527KB
-
MD5
a67e4139cb4e74a003553089528f7ad1
-
SHA1
6cd875b1c6e41f7e265c5acb014c9fa457c41fdb
-
SHA256
22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820
-
SHA512
a41ed54aaf3790c8cbc68fdbba36f89b50cbbada09aef625f60b68e652f0fe0af86d890a5ac5cc741ddc344359bf46cc794abdec77828cb88bc2b8d4efc6f20d
-
SSDEEP
12288:ZJVb8L4MtfjkopdqK/QRnp1w9cZJBYP543g4qXf3k:ZJVb0BfpdqKoR3wiZJBYG3gbvk
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1452-55-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1452-54-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1452-57-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\i9VVig6x\\i9VVig6x.exe" 22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820.exepid process 1452 22d0bc0d10bed5b8cd7ea7c866a982c3b38274be1998d4ef89ace90269e21820.exe