Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 05:16
Behavioral task
behavioral1
Sample
6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe
Resource
win7-20221111-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe
Resource
win10v2004-20221111-en
3 signatures
150 seconds
General
-
Target
6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe
-
Size
1.0MB
-
MD5
c1b380d1478da867b1397bba44f974ed
-
SHA1
d4b806d085ada7205df594fcab57f3785b846017
-
SHA256
6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3
-
SHA512
6bd4eafe72578725d19de7fbca6e8ff74dd92007dcce990ff8efd11b8dfba00ca9b58b2010893cb79d6711d5626d7dbf7833f2ad73f6f74f4d08f8826573d84a
-
SSDEEP
24576:hUAcBQKiC5donu3xjMjJpq0s7ftWWKRSjRKI:VutiCXou3ye0sM1ZI
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Fairy_Ape = "\"c:\\users\\admin\\appdata\\local\\temp\\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe\" /mode=icon" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fap\ = "fap.Document" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LAS\Content Type = "text/plain" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document\shell\open\command\ = "c:\\users\\admin\\appdata\\local\\temp\\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe \"%1\"" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LAS\shell\open\command 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LAS\shell\open\command\ = "c:\\users\\admin\\appdata\\local\\temp\\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe \"%1\"" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document\ = "LAScript Document" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fap\shell 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document\DefaultIcon 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LAS\ = "LAS.Document" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document\shell\open 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fap\Content Type = "text/xml" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document\shell 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document\shell\open\command 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document\shell\open\command 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document\shell\open\command\ = "c:\\users\\admin\\appdata\\local\\temp\\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe \"%1\"" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LAS\shell 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LAS\shell\open 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document\DefaultIcon 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fap 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fap\shell\open\command 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fap\shell\open 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fap\shell\open\command\ = "c:\\users\\admin\\appdata\\local\\temp\\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe \"%1\"" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LAS 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document\DefaultIcon\ = "c:\\users\\admin\\appdata\\local\\temp\\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe,3" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document\shell 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document\ = "Fairy_Ape Program" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document\DefaultIcon\ = "c:\\users\\admin\\appdata\\local\\temp\\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe,0" 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\fap.Document\shell\open 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LAS.Document 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4000 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe 4000 6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe"C:\Users\Admin\AppData\Local\Temp\6a8117d45037faf62d52b18df7bb9163e5e9ba5550968ef3d58ec1c5c9dcc0e3.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4000