Analysis
-
max time kernel
41s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 21:36
Static task
static1
Behavioral task
behavioral1
Sample
4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe
Resource
win10v2004-20220812-en
General
-
Target
4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe
-
Size
80KB
-
MD5
ff36f3db60070140af4e77367139b695
-
SHA1
4fb952e08e4b40b020c51479bdcabb8dd0fab4f5
-
SHA256
4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a
-
SHA512
a0b5c8e82286516933e9c360238e13e6e97560a88ed818378ffb3ce56e2e1712a1977126a9d444ea3a7e7e66a2fa39e7798fce483dd6b654f16d1c1463d7c9f7
-
SSDEEP
768:KZDsWM3RWhrSIrl3vokVVFbCeJt1awYF6olzQOF2mFxDBrSg4Iy+:mWPgl/oknFblHYw/olzQOF2mFzp
Malware Config
Signatures
-
Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntkrnlpa.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\setupSNK.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\explorer.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\hh.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\setup16.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\user.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\instnm.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe File opened for modification C:\Windows\SysWOW64\regedit.exe 4bce9d3ca6cfc9b7376a7b51cc6856a9251bf8da9773e984dc6b0c4412f1d21a.exe