40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Size

348KB
MD5

b0fbc0fd0ecce92d0208683fe164920b
SHA1

acf8ec276cdf3c1c56e7f6e7953a21183e75326d
SHA256

40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9
SHA512

a08f8f7b88d1bb27d2bd3e67db95b14cee5f46171c1123b9e1fc45b78d65a0cfe69d416d130472132db9194f81f70fe584633614adcf6fedc9a88093624aa0d9
SSDEEP

3072:cRC5OErz9SRMeu3kN3PCN4xEs3a5QSXBJu/jraulvP:cRCOEHSMeu3MCWx/sQSXzzut

Score

1^/10

Malware Config

Signatures

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\printto	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40A472~1.EXE /dde"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40A472~1.EXE /dde"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\ = "3Ddata Document"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\DefaultIcon	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\open	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\print\ddeexec	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\print\ddeexec\ = "[print(\"%1\")]"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40A472~1.EXE /dde"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\open\ddeexec	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\print\command	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\printto\command	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\40A472~1.EXE,0"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\open\ddeexec\ = "[open(\"%1\")]"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\print	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\printto\ddeexec	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\3Ddata.Document\shell\open\command	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2000	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
2000	40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe

C:\Users\Admin\AppData\Local\Temp\40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe
"C:\Users\Admin\AppData\Local\Temp\40a472963e62e2b491f432bd18659f43b6b818c54e2308f409713eaa76ec17b9.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/2000-55-0x0000000000260000-0x0000000000264000-memory.dmp

Filesize
16KB

Download